You have to wonder why an open source project required confidentiality about this. Incidentally, neither Safari nor Chrome, or any other browser as far as I know, has such a remote domain-specific kill switch for extensions, so you have to wonder why it was necessary in Firefox.

I believe that Mozilla already had the capability to remotely disable an individual extension, if it turned out to be malware. After all, every Firefox extension needs to be uploaded to Mozilla for analysis and cryptographically code signed before it can be installed in Firefox. [Edit: I've now confirmed that Mozilla has an extensions blocklist.] Given this preexisting capability, it's unclear why there should be a list of domains where all except a lucky few chosen extensions are disabled, regardless of whether the disabled extensions have shown signs of misbehavior.

The Firefox quarantined domains list is currently empty. Mozilla hasn't said which domains it intends to add, or even why a domain-specific list is required. I find this troubling. It's a feature with no apparent motivation, supposedly for "security concerns"—among other "various reasons"—but what are the specific security concerns here, that would be addressed by a remotely controlled domain list? Mozilla's opacity and vagueness feels almost deliberate, undermining our trust.