It is not so much about malicious code it's about information they gather about you.
You never know when it can be used and by whom.
"> Mozilla has a history of harming me. I've documented this as one more
> case of attacks from Mozilla to go along with everything else. I see
> no reason to put up with it or tolerate it. Mozilla should expect that
> one day they're going to be held accountable."
https://lists.torproject.org/pipermail/tor-dev/2019-August/013995.html