The part where there is only one party who can make the scary warning go away and doing so requires paying them.
I mean you could try to do a web of trust kinda thing but you would still end up paying someone.
I get where you’re coming from that they could just not have the scary warning but the fact that it’s hosted on Mozilla’s site without a warning already lends a lot of legitimacy to what should be seen as “some random person’s add on.”
It's like putting a sign in front of a retail store that says "make sure you trust the proprietor before patronizing this store" -- it's not saying anything that isn't true, but it's also going to be a direct cause of fewer people patronizing the store, even if the proprietor is trustworthy.
If the sign then only comes down by paying money to the party who put up the sign, well, now it's a racket.