Yes, but being the man in the middle is much easier when the target willingly places you in the middle of his connection... The whole situation can be worked a

Yes, but being the man in the middle is much easier when the target willingly places you in the middle of his connection... The whole situation can be worked around by using a custom prefs.js that disables auto updating addons (there are various other attacks that can be prevented by tweaking settings in about:config such as the webrtc related ones) and there are various websites providing privacy oriented prefs.js. A better workaround would be for the TOR browser maintainers to ship such a file with it, and a solution would of course be Mozilla fix things on their side.