Might be simplest to just create a user through the DE, then "su -c" from my main user to run the browser?
However it should be possible to configure your system such that it doesn't like such: https://wiki.archlinux.org/index.php/xorg#X_clients_started_...
And, of course, there's always the paranoid option of "run the browser within a virtual machine", so an attacker would have to break the browser, then get local root within the VM, and finally find an exploit for the VM, before getting to your files.
Mind that Firefox is also getting sandboxed tabs as we speak, so yet another layer that attackers would have to get through, which wasn't in place at the time of this attack.