TooFastIndeed

Because this is not the scenario that is being denounced here. A brand new add-on with functionality unrelated to the product is being installed without consent or even notification - that's capital M Malware peddling.

Automatically updating an already enabled add-on is hardly the same thing as silently pushing a new one.

Security updates were and still are configurable to be installed after prompting, also when they are installed automatically I am notified that this has happened. There is also an implicit trust in the vendor that only security-related functionality should be changed in a security update.

I understand it all too well, but when Mozilla is posing as a public benefit company with the "good of the Internet" as its mission this kind of stuff is inexcusable and should be called out all the louder.