The affiliate link hijacking was not opt-in. How could anything remotely like this be accepted in a privacy focused browser?
When Firefox had the mr robot extension incident everybody was (righfuly so) mad, but that was way less damaging than altering users' intent.
Is their shift key broken?
Furthermore, this blog post has outdated information and many of their problems with Matrix are fundamental for federated protocols. Good luck removing an email sent to another server, for example. JSON form is very well defined.
I can agree with the problem of DAG complexity building up, sure, but that is a tradeoff.