It is not so much about malicious code it's about information they gather about you.
You never know when it can be used and by whom.

">     Mozilla has a history of harming me. I've documented this as one more
>     case of attacks from Mozilla to go along with everything else. I see
>     no reason to put up with it or tolerate it. Mozilla should expect that
>     one day they're going to be held accountable."

https://lists.torproject.org/pipermail/tor-dev/2019-August/013995.html