Thank you for raising the concern. Pontoon Add-on is being built by me as a long time Mozilla l10n contributor and we paired with the Pontoon team to promote it for users, who may not know about its existence, to improve their experience mainly with how the notification system works. As part of that I granted full access to members of the team to all the infrastructure Pontoon Add-on has, including the source code, so Mozilla staff has control over it.

On the other hand, this does not included the teams, who manage addons.mozilla.org or develop extensions "by Mozilla", and that's why the warning is shown on the add-on page. You are right that it does not look that good, and I will try to resolve that and get Pontoon Add-on onboarded to any process that the team will consider necessary.

Michal Stanke

EDIT May 21, 2021: We managed to include Pontoon Add-on in the process of security reviews by Mozilla Add-ons team. The current version has been reviewed and all future versions will be reviewed by the team as well.