> Because any extension or sufficiently capable malware on your system can change about:config values, meaning that if Mozilla ever makes a mistake in the extension approval process and lets a malicious extension slip through, or you get such malware on your PC, then that extension/malware would be able to flip that config bit and open the flood gates for all malicious extensions.

If such a malicious extension or other malware got installed, it could already do anything another malicious unsigned extension could, so I don't see how having this setting weakens security under the assumption that there's already malicious code running.

If we assume a system is compromised, it may as well install other malware as normal binaries instead of a Firefox extension.