I think it's justified in this case. Mozilla suffers from a schizophrenic existence where they are simultaneously non-profit and for-profit, and Firefox privacy-friendly and unfriendly. For example, Firefox supports HTTPS-only mode and DNS over HTTPS, but they are not on by default. It also ships with DuckDuckGo and other search engines in the setting drop-down, but alas, that $10M/year or whatever they get from Google is too good, so fuck your privacy. You then have to manually turn all that shit on, because they won't, to the point where installing a fresh Firefox on a system now requires a bit of a rite of passage before you can get a useful browser. Do all these things I mentioned really increase your attack surface?

Also, mandatory mention: https://librewolf.net/

I wonder if you are on the group that think that DNS over HTTPS is obviously and unambiguously a benefit for security and privacy, and of course nobody disagrees; or in the group that thinks that it is obviously and unambiguously a threat for security and privacy, and of course nobody disagrees.

Neither? That setting is perhaps not a clear default among the ones I mentioned, especially because I personally wouldn't want to send my DNS requests to fucking Cloudflare or something based in the US. But I still stand by my comment that Firefox's defaults suck. At the very least they could have a useful one-time wizard that doesn't just ask you to import your bookmarks from Chrome.