The problem isn't security per se, it's compatibility. Exposing all the browser internals to extensions means that all the internals are part of the platform's public API and it's almost impossible to change anything. A lot of HN users will be like "that's fine, software should be finished, I don't want any more features", but things like performance and especially security require ongoing maintenance. The particular thing that killed off Firefox's old extension model was that it blocked migration to a multi-process architecture, which was clearly necessary even at the time and became even moreso when Spectre showed up a couple years later. "Warning cones and blood red messages" do not solve this because a vulnerable architecture exposes all users to exploitation, not just those who choose to use sketchy extensions.
(Also we know from long experience that "warning cones and blood red messages" don't in practice suffice to prevent end users from being exploited, but that's a separate issue.)
It should also be pointed out that the Firefox devs spent years and countless dev hours trying to keep the old extension system and solve the problems wrt. multi-process, security, performance, and compatibility. They removed the extension system only after they tried everything else, and mostly failed.
They also spent tons of effort explaining the background of these choices and why they felt they had no choice and this was the only path forward. It's disappointing people are still coming up with this "oh, why don't they just [..]?!" type stuff.
(Also we know from long experience that "warning cones and blood red messages" don't in practice suffice to prevent end users from being exploited, but that's a separate issue.)