We often see calls that Firefox should block outside programs from installing addons. That would be nice, but as long as installers have write permission to the Firefox directory, there is no way to block them. Mozilla could try to make it difficult, but the toolbar installers would just use more hacky methods, which would break Firefox even more often than it does now.