Because it's hard to tell the difference between "users" and "malicious software running on their computers".
If there's a privilege level that allows for one but not the other, that sounds like something Mozilla should fix.
"We accidentally uploaded all your HTTP requests to our servers, but we will definitely fix that in next addon version!~"