How do you reconcile the fact that mozilla addons can spy on you?

I’m still debating, but I probably won’t install any addons to my browser after seeing that it has all your data.

What’s stopping CIA or NSA approaching Raymond Hill with a fat paycheck and in exchange asking to access all user data?

You’re giving the plugin, which is locally installed to access these things, you’re not giving the developer access to those things. For example, look at “store unlimited amount of client side data” which is all local.

uBlock Origin for example is open source. You can go and see their code and check if it’s reporting back.