How so? Either they already have access to my computer, in which case browser addons are the least of my concerns, or they've compromised Mozilla in some way in which case who's to say they can't sign their fake addon too?