Here [1] is the BMO ticket tracking this. I guess the main reason it hasn't been implemented is that there have been several issues with other browsers' implementations, as mentioned in the bug ticket. And every now and then, a new one pops up. You can still get the feature by using NoScript.
There's a better solution though: CSP. Yes, it requires action from the site owners and is a bit of a pain to implement on an established website, but it's very effective at fighting both reflected and persistent XSS, and it can prevent other attacks too, such as content exfiltration using dangling markup injection.