1. Zen Browser had remote debugging enabled by default and disabled the security prompt for it. Extreme incompetence or malice?
https://github.com/zen-browser/desktop/pull/9272. Social trackers are selectively allowed, unsigned extensions are enabled by default, and Enhanced Tracking Protection isn't fully implemented.
There's just a theme of incompetence, trying to cover it up and just in general being clueless about security.