Yeah, this is the tradeoff. It takes a long time to audit code. Supposedly Mozilla is doing this every time an add-on update is sent for review. Google and Apple just pretend like they do, and I guess Mozilla didn't get the memo that you're supposed to pretend.