At least this is opt-in, and Firefox still allows for manifest v3 extensions, and, on the whole, isn't using a engine funded by a billion dollar company that's doing everything in it's power to spy on you.
At the risk of committing whataboutism - the same can be said about Facebook, Google, etc. And I don't say that to marginalise the problem. Quite the contrary - I honestly feel it should be illegal to gather this level of personal detail about people.
That the focus right now is on tiktok is suspect, to say the least, but I guess the upside is that the problem is getting attention now.
As The Times told BleepingComputer last week, the attackers used exposed credentials to hack into the newspaper's GitHub repos.
It explicitly says the credentials were leaked. If you're really going to insist the word "hack" implies something else, I'm afraid you're too far on the spectrum for me to continue this conversation. Cya!
You, me, a few other people.