It uses add-on gating similar to what they do for Web MIDI, so it's not exposed to users unless they specifically opt into it.
https://hacks.mozilla.org/2026/05/web-serial-support-in-fire...
https://hacks.mozilla.org/2026/05/web-serial-support-in-fire...
Hopefully they will move to a better solution that offers some integrity guarantees instead, like https://rwc26.waict.dev/ that they have an early implementation of in nightly builds.