I get the feeling that a lot of users really don't believe XUL, etc. is inherently less secure. I cannot say either way myself, but without the capability of the old plugin system Firefox has no real advantage over Chrome. It probably doesn't help that they are going with something compatible with Chrome which leads to a "why not just use the original" thought process.

I get the feeling that they could have got the new system done and as capable as the old before deleting the old. Transition periods are brutal as Python and Perl have found out.

That's not really true. Chrome is more secure because it's designed better, they have very good and mature sandboxing for the parts of the browser that work with data from the internet, and because they work very hard at improving their codebase. They have their own LLVM fork!

WebExtensions can still read all your data on all websites and inject whatever they want into all websites. Not a lot of security there. That is OK though, I am fine trusting Google and Gorhill instead of just Google.