It was possible to download lossless FLAC files (they got them straight from Deezer) though, so higher quality than anything downloaded from Youtube etc.

Did you read the sentence before that? A malicious website could read data from other websites(opened in different tabs), and also passwords stored in the browser, etc… There is no additional system exploit needed for that

Here you can find a good explanation on that.

Mull (from the DivestOS developers)

But nowadays I’m using a Chromium based browser on my phone because Firefox on Android doesn’t support process isolation