* They pushed ad/extension for a TV show to everyone
* They silently served modified installers to a small subset of users downloading firefox which sent all browsing data to a 3rd party by default.
* Disabling experiments used for pushing the mr robot ad does not disable "normandy" - which is practically the same thing and they used to push new certificates once their old ones expired and broke addons recently. This feature is hidden in advanced settings.
And then as you say, using google analytics everywhere (giving google data), painting google indirectly as evil while having it as a default engine and collecting google money.
> * They pushed ad/extension for a TV show to everyone
I assume you're talking about the "mr robot" thing here as well. One can accuse it of being many things, but it wasn't a privacy violation, as no data was sent (or planned to be sent) to anybody, either to Mozilla or any third-party. (It was silly, an abuse of studies, a source of worry for those who monitor their list of add-ons for suspicious items, and a strategic error.)