Because bad guys can just keep getting new certs when their old ones are revoked, unless you do identity validation (which costs money as it requires actual humans, so the certs can't be cheap or free).

Reviewing plugins costs somewhere around the same amount of human time/money, no?

If their review are as thorough as Android app's one, they cost about nothing.

Add-on reviews are done largely by volunteers.

the addons signage is an automated process.

The fact that he only lists the about:config way doesn't mean that this is the only way to do it. Many of these options have GUI prefs.

As that article points out, the Corporation is a wholly-owned subsidiary of the Foundation and therefore shares its public benefit purpose.