Installers on Windows run with administrator privilege and can do anything they want, including modifying the Firefox binaries. We might end up with an arms race between adware vendors forcing their stuff into Firefox and Mozilla trying to disable it.
If an installer modified the binary, Firefox couldn't stop that. What installers actually do is move some plugin files into the global Firefox plugins folder, so they get loaded on next startup. Because you can't uninstall the global plugins from the user's account, they added a per-user setting that keeps track of which "global" plugins that user has allowed.
That wouldn't be anything new, and the system's malware detection should help. Although it's a hard problem if users insist on running random binaries, of course.
