Yeah, this isn't a great solution, but it's been surprising the number of Mozilla folks that have come out and said, "this may be the only real solution". They've all said they won't be doing the same thing, but there has sometimes been a strong suggestion of a "yet..." there.
I don't think:
a) most people realize that extension permissions are not exactly analogous to phone permissions. When you give browser extensions even fairly standard permissions, they can arbitrarily interact with and alter every single thing you see and do in your browser (meanwhile phones are still somewhat protected by their isolated app architectures). There are some mitigation strategies, but the reality is that the only real difference between many userscripts and a keylogger, for instance, is intent on the part of the developer. And how do you detect that?
b) I don't think many people reacting to this change (like in this thread) realize how many people are actively installing malware in the form of extensions and are being screwed by them. These aren't hypothetical problems, it is quite widespread (check out the many Mozilla conversations about this). This is the reason Mozilla has been so sympathetic to (and muted about) Google's change here, I think.
A dropdown bar and a "are you sure?" are not sufficient. I wish Google would do more (and the "I intend to polish this UI a bit" comment in that bug thread should tell them exactly where they should be focusing their efforts first, not just ignoring it for now), but browser extensions are way too dangerous right now. Downloading the folder and dragging it in kind of sucks, but it's really not that bad in almost all cases (I'm sympathetic to the drop in installations you'll face if you don't want to kowtow to the chrome webstore/mozilla addon approval process, though).