You're right, and Pocket being integrated into the browser itself rather than remaining a plugin was the one that drove me to Waterfox a few years ago. I just listed a couple of general issues above for brevity's sake.
Before they bought Pocket it was a plugin/service that was completely optional. They bought Pocket and integrated it into the browser at a much deeper level, making it opt-out instead of opt-in (and very difficult for the average user to opt out; you have to change several settings in about:config which most users have no idea even exists).
I felt they should have made it an opt-in service that the user can choose on the first launch. Taking away user choice is rarely a good thing, and even less so when dealing with anything privacy related.
Pocket, the service for collecting and syncing articles, is basically a separate thing from pocket suggestions.
The original service was integrated a while ago, but it doesn't really have severe privacy implications. If you click a pocket button, it asks you to log in. If you don't click, it does nothing. This is the one that's hard to disable, but it's an annoyance more than a security problem.
Pocket suggestions are newer, showing articles on the new tab page. They are trivial to turn off, and for what it's worth all the sorting/filtering is done locally.
It's the automatic opt-in that concerned me more than anything; any time a company chooses to force a new feature on their users I question the necessity of the action as well as the intent. I had the same issue with automatic opt-in of their telemetry and Studies; I never asked for that and I don't expect it from a company that touts their stance on privacy as a reason to use their software.
My point being, even if Pocket is 100% benign and never leaks any user data, the user should still have a say in whether it is turned on by default on a fresh installation. Anything less is user-hostile, a descriptor Mozilla should avoid if possible.