Mozilla has a lot of metrics of things like webcam permissions and quite a lot of data on how often that goes wrong in practice (websites that get more permissi

Mozilla has a lot of metrics of things like webcam permissions and quite a lot of data on how often that goes wrong in practice (websites that get more permissions than users meant to give them; websites that abuse permissions after they've been granted them; etc). If Mozilla thought a permissions flow was all that was needed to make Webserial safe, they would have suggested it. I'm sure they have plenty of empirical data to give them enough reasons why they suggested that a permissions flow wouldn't be enough to keep this safe.