Earlier quoted context omitted.
> has better addons The add-ons might be better, but XUL-based Firefox add-ons are not better. They essentially give full control of your computer to the developer of the add-on. There's no permission model. The "APIs" are mostly the internals of Firefox itself, and when Firefox updates, lots of add-ons break. Most add-ons can be ported to webextensions. The ones that can't probably shouldn't have ever been add-ons t…
>XUL-based Firefox add-ons are not better. They essentially give full control of your computer to the developer of the add-on XUL does open up more attack surface than a web extension. However, web extensions open up enough that you're already in the business of trusting the creator of the extension. A web extension is fully capable of stealing my online banking credentials, for example.
Those were my thoughts exactly.
And tangentially related to your point, I am wondering why the addon developer, who I have explicitly trusted by intentionally installing their software, is not at least on the same or even higher level of trust as an unknown 3rd party web developer whose arbitrary Javascript application the browser automatically installs and runs when I visit a desired 1st party website?
There are no built-in protections that Firefox (or any browser) provides for running arbitrary 3rd party code that happened to be included by an unsuspected website that features 3rd party fingerprinting, tracking user actions, access to DOM, whether for "benign" or malicious purposes. In my mind that is just as, if not more, important for both security and privacy.
It looks like it is yet to be seen whether Mozilla's extended WebExtensions API will provide enough for existing add-ons that use current low-level access that to some level restrict 3rd party web applications.