Security on passwords stored by Firefox, against add-ons

Question

I am wondering how safe are my passwords stored in the passwords manager built into Mozilla Firefox. Currently I am using Firefox Quantum 59.0.2 64-bit under Ubuntu 16.04 in one machine. I guess reasons to be concerned about may be various, e.g.:

1. Add-ons.
2. Other software having access to the filesystem.
3. Others?

My focus is now on item 1, and I guess here it is irrelevant which OS I am using, but only the version of FF (is this correct?).

As regards add-ons, this old answer sort of brings a red-alert. Things may have changed since then (even though it seems to me they didn't, as for that answer). This is also worrisome.

My questions are:

1. What are the possible mechanisms an add-on can have to: a) read, b) exfiltrate my passwords?
2. What are the easiest ways to make sure (or against the lack of that, arbitrarily trusting somewhat) that is not happening, in each case? I emphasize easiest since, I guess, an extreme answer like "become a specialist in security and code development, and read the add-on code" is always valid... I mean to apply solutions as easy as possible.
3. Why wouldn't it be possible to have the same security level with FF as with Keepass (e.g.), if the same encryption algorithm were used? (in Security on passwords stored by Firefox vs password manager I ask about a comparison of algorithms, which is a separate issue).

---

Related info, which I didn't find it answers the question:

Do Firefox add-ons have full access to passwords etc?

Answer 1

1. It can not read them directly from the manager. It may however obtain it indirectly, for example modify the websites you log into, if it has permission to modify websites. This allow it to for example modify the form to send the password tp them instead of sending it to the legitimate site.
2. Not to have add-ons you don't need. Use widely used add-ons. Check that permussions of add-ons make sense. Use open source if possible.
3. If you disable sync, it kind of is possible, though kee pass has additional abilities like allow/deny autofill on case-by-case basis, which FF probably won't ever have. But this is a bit of a moot point as FF is not focused on security to the extent to make it equivalent with KeePass

PS: point 1 is assumeing FF's sandboxing works and has no vulnurabilities, which is most likely not true.