Disclaimer: I am the author of this article. Yes, default Content Security Policy of add-ons doesn’t allow eval(), and they likely couldn’t figure out how to c

Disclaimer: I am the author of this article. Yes, default Content Security Policy of add-ons doesn’t allow eval(), and they likely couldn’t figure out how to change it. So it might be that they never even realized the security impact of these changes, which makes it even worse.