Also, such an API would allow an extension to make the browser UI unusable, which would make figuring out the problem and removing the offending extension quite hard.
There are no security reasons for not having such a setting. None.
I doubt that's the reason.
https://bugzilla.mozilla.org/show_bug.cgi?id=1332447
This comment kinda sums up why it's a hard problem https://bugzilla.mozilla.org/show_bug.cgi?id=1332447#c116
There's a major problem with addons doing stuff the users don't want, and the tab strip is a critical portion of the user interface so "just let them hide it" has problems with abuse. So it needs to be something that can still be autoreviewed, and it needs to be something that gives clear indications to the user as to what is going on.