They should have forked AOSP instead and included F-Droid and Firefox by default. Maybe tweaked some things, like replacing WebView with a Gecko solution, adding first-class Web app support, etc.
But you're right that some permissions like complete file access might be a bit too much. They could implement it so that only signed Web apps installed through the app store would get such permissions.