NPAPI "plugins are a source of performance problems, crashes, and security
incidents":
https://blog.mozilla.org/futurereleases/2015/10/08/npapi-plugins-in-firefox/
Mozilla didn't remove the entire NPAPI code base. They still support Adobe
Flash. If the stability and security bothered them so much, they would have
removed the entire NPAPI code base. You can watch videos in the browser using
HTML5 and Flash alternatives like Gnash (if they work) but you cannot use VLC
or mpv. The reason Mozilla supports HTML5 and Flash is not due to security
but rather in order not to break websites which require these technologies so
that users will not leave them. If they cared so much about NPAPI security,
they could have improved the security of the relevant code in their browser
(and worked with free software NPAPI add-ons as well so that they would be
secure as well). They removed partial support for NPAPI because they didn't
want to support it anymore (and because only a minority of users use NPAPI
plugins which aren't Flash) and because other browsers did it as well. It's
the same reason why they added H264 and DRM to the browser - other browsers
did it and they were afraid users would leave them if these features weren't
implemented.
WebExtensions' API does not expose Firefox's internals as much as XUL/XPCOM,
eases developers' life (almost no work to port from Chrome to Firefox) and,
as a consequence, will get us more add-ons.
Removing web extensions is more likely to alienate existing add-on developers
who will switch to other browsers and not bother to create new addons (which
might not even be possible). Mozilla doesn't lack add-ons, so it doesn't need
add-on developers to port add-ons from other browsers. The chances are that
for most users several existing add-ons will break, and they will simply
switch to other browsers such as Google's browser, which will reduce
Mozilla's browser's market share even further.
I can imagine users refusing to install Mozilla's browser if they do not wish
to use PulseAudio, since it is the only main browser not to support ALSA.
GNU/Linux users already lost sound when they upgraded Mozilla's browser (you
can read about it here:
https://news.slashdot.org/story/17/03/17/1644211/firefox-goes-pulseaudio-only-leaves-alsa-users-with-no-sound
) and chances are they simply switched browsers if they couldn't be bothered
to (or refused to) install PulseAudio. The reason Mozilla dropped support for
ALSA was because it requires more work to support than Pulseaudio (and
because much more work is required to support sound as Mozilla added support
to new audio and video formats in recent years), so they preferred to drop
support so they could focus on other features in the browser.
