Firefox isn't “pre-downloading”. You chose to start downloading by selecting “Save Link As” in the menu, or left-clicking on a link whose content type has no internal or external handler. Once Firefox has started downloading, it prompts you for a save location. As long as you haven't entered that location, it downloads the file to a temporary directory (platform-dependent), either with the server-supplied default file name plus a
.part suffix or with a randomly-generated file name (I think that depends on the version, perhaps on the platform as well).
Firefox needs to start downloading before prompting you for a file name, because the default file name can be supplied by the server: the original link could be a redirection (so Firefox needs to initiate the connection and read the response code, and there could be a file name in a
Content-Dispotition header (so with a 200 response, Firefox needs to read the headers).
There is no security risk here. When you click on something in a browser, it is expected that the browser will establish a connection and download the content at that link. Sure, there could be security issues (e.g. the content may trigger an exploitable browser bug), but that is a risk that you take by using a browser in the first place. To have every click in a browser pop up an “are you sure?” dialog box would be a usability nightmare, with no security benefit since you'd be clicking “yes” all the time anyway.
Ok, Firefox could pause the download after the headers. But that wouldn't serve any useful purpose (in addition to being bad for performance and usability). The exploit could be in the headers, after all.