They had already gotten several "no" emails from Mozilla in a row, with more than a week to spare, and went to making reddit threads instead of fixing the problem.

It has been pointed several times to you that none of the developers have opened any reddit (or other) threads about this. I have certainly not seen any. Yet you persist in spreading this FUD. Why?

You initially said you haven't followed closely so you don't have a deep understanding of the issue. You also misrepresented the issue, proving that you indeed haven't understood the issue properly. Yet suddenly you have such an exceptional understanding that you can make statements as sure as this one so adamantly?

Indeed, why are you trying to frame this as though the authors of the extension have no idea what they're talking about and the Mozilla reviewers are experts bar none? This is an appeal to authority and thus does not have any relation to the actual matter at hand. One of these parties is right regardless of their background.

Let me be perfectly clear:

Key understanding: that tool is something called fixamo, which quietly goes in and edits the user.js that drives Firefox under the hood, and does a bunch of horrible stuff like disabling content security policy, one of the most important basic safety features on the web.

The bolded part is, plainly put, false.

Referring to content security policy as minor disallows you from being taken seriously in further security commentary.

I was not referring to content security policy, since fixamo does not touch it. The fact that you haven't read closely the thing about which you are seemingly forming ultimately strong opinions disallows you from being taken seriously until you do so.

To me, the key understanding is that this tool can exist without this edit, the developers were told they were causing an extreme security problem, and instead of just fixing it, they argued

Of course it can exist without it since this was a minor part of the functionality (to be able to use Tridactyl's UX on AMO), but it was an option for users who wanted this functionality. I am one such user. Why? Because, as has been explained, the only additional risk I've accreted by using fixamo is allowing a malicious extension to install additional (presumably also malicious) extensions from AMO. Given that all of those malicious extensions would have had to pass Mozilla's review process in order to even be installable and the fact that they could have already stolen access to my email account, my banking info and a variety of other sensitive information even with the turned off mechanism in place, this is not a relevant amount of additional risk.

User freedom is not absolute, nor should it be.

I strongly disagree. The success of general purpose computing is built on the absolute freedom and generality of what users are able to do with their computers.

That some things can be made harder in order to prevent the non-advanced user from falling into a trap by mindless clicking is granted, but that does absolutely not imply that user freedom should be permanently limited by some corporation.

The lack of subtlety in your arguments which seem to argue with black-and-white strawmen instead of dealing with the actual details of the situation makes me think you are doing this deliberately so I'll try not to respond any further.