Well, not directly: they'd need root to overwrite /usr/bin/firefox, which it wouldn't normally (hopefully) run as. They could have latent malicious code which

Well, not directly: they'd need root to overwrite /usr/bin/firefox, which it wouldn't normally (hopefully) run as. They could have latent malicious code which gets packaged and that could download a payload and execute that (or already contains the attack). But a program without such a pre-existing ability won't be able to update itself to a version that does.