There are security checks for detecting userChrome.js. My understanding is that Firefox is going to let people customize as before but just not enable some security enhancements for those users. https://searchfox.org/mozilla-central/rev/02bd3e02b72d431f2c...
What are the "security enhancements" that those users are missing out on?
Essentially, it allows calling eval[1] and executing "privileged loads"[0] in some elevated contexts (the System Principal, which is responsible for the browser UI[2]).
Those are useful mitigations, but disabling them for some custom user-chrome is unlikely to have a meaningful impact on your browser's security.
[0] https://searchfox.org/mozilla-central/source/dom/security/ns...
[1] https://searchfox.org/mozilla-central/source/dom/security/ns...
[2]: https://blog.mozilla.org/attack-and-defense/2020/06/10/under...
First one I found was blocking of eval()
https://searchfox.org/mozilla-central/source/dom/security/ns...
Chrome scripts require careful security analysis, just like software that runs with root privileges.
Firefox ships with zillions of lines of chrome script, and none of those zillions of lines "downgrade" any security features. Software isn't automatically secure simply because it came from Mozilla. Microsoft tried the same nonsense to scare people out of using Linux at one point... you'd have to be nuts to run kernel code that didn't come from Redmond!