I think you're missing my point, so let's specify a bit more of a threat model. Attacker has code execution on your system and wants to maintain persistence an

I think you're missing my point, so let's specify a bit more of a threat model. Attacker has code execution on your system and wants to maintain persistence and exfiltrate sensitive browser data. Sounds reasonable for Mozilla - at least, it's not totally nuts of them to consider this in their threat model. One avenue, and a popular one, is to then sideload a malicious extension. An attacker who can disable the extension check can do this easily. An attacker who can't has to resort to other means - packaging a separate payload to host the extension. Does that sound reasonable? I don't want to argue, just to explain my perspective on this issue based on the attacks I have seen.