Trust isn't a single static Boolean value. It depends on the situation, reputation, and many other factors. Trust is continuously re-evaluated; just because someone's coding ability was trusted in the past does not imply that their current or future actions will also be trusted.

However, the current problem people are criticizing is not about Mozilla's choices for default preferences. The specific changes they ship with the browser or update with Normandy are not (currently) particularly interesting. The problem is that a new way to remotely control the browser was added unannounced that bypassed existing update methods.

If you want to change other people's property, you get permissio9n first. If someone doesn't want to give you permission and you change their property anyway, we usually call that something like "trespassing", "vandalism". It doesn't matter if you think it's an important change or if you don't understand (or even know) their reason for not granting permission; their computer is their property, and they don't have to justify why they want to use it in any particular way.

Yes, technically code and preferences are both the exact same thing: code. Preferences are declarative code, but so are Webpack configs and Rails apps and UI schemas and all kinds of things.