- More malicious apps found in Mac App Store that are stealing user data - https://appleinsider.com/articles/18/09/07/more-malicious-ap...
- How 18 Malware Apps Snuck Into Apple's App Store - https://www.wired.com/story/apple-app-store-malware-click-fr... ...
A corollary… just because one piece of software has fewer reported CVEs, doesn’t mean it is more secure.
It sort of does, it's just not something devs take advantage of or that exists in an official way.
If you don't want to be listed in the addon store, you can do a signed addon that goes through a much less rigorous check and then distribute it however you want. Similarly within the addon store Mozilla has a concept of "vetted" and "unvetted" addons. You end up with roughly 3 layers of validation.
There's technically nothing stopping anyone from setting up a separate addon store using only the 1st-layer of validation (or even adding a wrapper around the 3rd layer of validation since it's all still ultimately XPI files). Automatic updates would even work, you can specify URLs to check updates from. I haven't fiddled around with it much though.
And sure, it would be nice to be able to skip even the 1st-layer signing when necessary, but what exists is still better than what a lot of other app-stores allow and in practice I suspect most addons aren't going to have trouble getting their stuff signed, so it's (likely?) not a huge deal if you wanted to make a 3rd-party store to require Mozilla-signed extensions. Maybe there's something I'm missing though.
https://extensionworkshop.com/documentation/publish/add-on-p...
> All add-ons are subject to these policies, regardless of how they are distributed.
and
> Add-ons with the sole purpose of promoting, installing, loading or launching an outside website, application or add-on are not permitted.
I believe the only way to bypass this would be to disable add-on signing in your browser, which is probably a bad idea.