Security concerns are exactly the reason the format doesn't have native support yet. However: https://github.com/mozilla/standards-positions/pull/1064
Also the parent comment was about that you really shouldn't just let a random Russian guy run any javascript on any website you visit, that's stupid.
Also also, am I missing something, or Firefox extensions are broken, there is no way to limit an extension to websites (allow or disallow), or even just to check the source code of an extension?
So what, you think they were just lying when they said that they'll ship JXL when it has a Rust implementation? You think Mozilla devs were just bluffing when they were working directly with the JXL devs over the last year to make sure everything would work right?