the affiliate theory sounds right to me, the hijack only pays if every search goes through their tagged link. for locking it down, regular Firefox supports enterprise policies. on Bluefin it’s the system Flatpak, so put a policies.json in /var/lib/flatpak/extension/org.mozilla.firefox.systemconfig/x86_64/stable/policies/ with ExtensionSettings set to “*”: {“installation_mode”: “blocked”} and “uBlock0@raymondhill.net”: {“installation_mode”: “force_installed”}. that removes the junk, blocks new installs and he can’t uninstall uBO again. restart Firefox and check about:policies to see it applied.