Orion has proven that web extensions are allowed, even if its implementation isn’t complete. There’s no guideline preventing a browser with a user-hackable UI (like Firefox userChrome) but nobody’s tried that yet. What’s left? As far as I’m aware, it’s just the small handful of manifest v2 request interceptor APIs that uBlock Origin depends on that can’t be supported fully.
This doesn't matter as long as essential features of Firefox aren't allowed by Apple.