Triggering an XPI installation does prompts the user, and so it should be treated as other popups and permissions prompts that a webpage are able to trigger and require a user gesture.
Bug 1759737 Comment 0 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
Triggering an XPI installation prompts the user, and so it should be treated as other popups and permissions prompts that a webpage are able to trigger and require a user gesture.