Yes, but I didn't talk about standard users. Also, most of my extensions are not...

Yes, but I didn't talk about standard users.

Also, most of my extensions are not 3rd party code and I want them to have full access.

For the rest I update them once in a while and go check

    ~/.mozilla/**/*.xpi

for changes with something like this.

    find -maxdepth 1 -mindepth 1 -type d ! -name .git -print0 | xargs -0r rm -rf

    for f in ../extensions/*.xpi ; do
            unzip "$f" -d "$(basename "${f%.xpi}")"
    done

    git add -Af .
    git commit -m "Changes"