Also extensions (a.k.a. addons)
https://www.securityweek.com/ghostposter-firefox-extensions-hide-malware-in-icons/
But but but… I need my DarkReader dark mode 
In all seriousness though, while I am glad that dark mode is an option that exists for about more than half the sites I frequent. I just light up/turn on the lights of the entire room I am in so that it is less stressful to the eye for those sites without dark mode.
You’ll take Vimium away from my cold dead hands!!
In all seriousness, you are right. The only extension (I believe) one should consider is the extension for their password manager, and probably uBlock Origin. After that, it’s a risky game.
No extension gang 
I actually really appreciate dark mode too so extension must needed for me.
I also use LibRedirect for redirecting YouTube and more platform links to privacy friendly front ends, Making YouTube (non-privacy frontends) bearable extensions (SponsorBlock, DeArrow), Banishing X and making it twitter and also make it bearable and removing the algorithmic feed using control panel and of course contributing to tor project with snowflake and that’s really it assuming I uninstalled ToS;DR because I don’t use it anymore.
No extension gang my butt, it literally can be a QoL improvement (with the correct extensions)
For those who can’t live without extensions, you can also reduce risks by logging into important accounts only in incognito mode or using a separate profile, with fewer or no extensions.