2. Social trackers are selectively allowed, unsigned extensions are enabled by default, and Enhanced Tracking Protection isn't fully implemented.
There's just a theme of incompetence, trying to cover it up and just in general being clueless about security.