They...already do that? They stopped allowing unsigned addons, even if you allow them in about:config (a power-user feature). Even Chrome allows you to toggle the option to do that -- in a more user-friendly way! -- and actually honors it, so I don't think it's the massive security hole everyone claims.

Edit: My Hitler parody of when Firefox introduced this (almost 10 years ago now!): https://www.youtube.com/watch?v=taGARf8K5J8