At this point, I think we should all slow down and wait until Mozilla does their internal investigation and makes some sort of statement. It's clear that a screwup occurred, but not clear precisely what the screwup was.

From the outside, it looks like something that was unfinished and supposed to be opt-in was accidentally rolled out to everyone, which suggests a problem with release management or code review process, combined with human error. But this is speculation. Whatever happened, scaring people with something that looks kinda like malware and having a PR shitstorm was clearly not the intent.