> I still think that a more secure version of XUL could offer a better user experience

In a way, webextension experiments are exactly that; you have complete access to all the “privileged” APIs in the browser, just like XUL extensions did. Problem is you need to toggle some prefs and use Dev or Nightly builds.