Nothing to do with DRM, the old model let extensions modify every part of the browser that could be touched via JavaScript (and since the browser UI itself is m

Nothing to do with DRM, the old model let extensions modify every part of the browser that could be touched via JavaScript (and since the browser UI itself is made with XUL and JS that's quite a lot of it) and even allowed using C++ to access all of the compiled guts as well. That is impossible to support sanely (every change is a breaking change to something) and is a security nightmare as well (users have no idea what an extension can do unless they read the code, if it's even available). The new model is sandboxed JavaScript that gains all potentially unsafe functionality via somewhat fine-grained permissions which means you have a good idea what an extension is capable of and know it can't do anything unexpected like grabbing random files on your disk. The downside to this model is someone actually has to think about what an API should look like and what the security implications are and then do the work to implement it. Before if someone made an API great but if not you could just do it yourself.