The threat model is reasonable behavior + a single warrant or data leak. It may not be the most likely way of compromise, but it's very possible, and such small insecurities add up. Mozilla should be making such compromise less likely, not more.