From reading the backlog, and after having gone through a lot of extension settings code/fixes, I'd consider, as others have said, that we only flip the pref when all container extensions have been uninstalled. We currently flip the pref if one is disabled, but that may happen (in the future) just by entering safe mode. Actually, one patch I need to address safe mode/extension issues will flip this pref.
If any container extension is installed, we enable
If any container extension is enabled (we could lock the pref at this point)
If all container extensions are disabled, it is unlocked. If the user turns it off at that point, data is removed.
If all container extensions are uninstalled, we reset the pref to what it was initially (ie would remain user set if that were the case)
Even with the above, it seems a little unreasonable to remove data when this is flipped by the user in preferences and not notify them first.
So, if the above extension changes are acceptable, lets make a new bug for that part, but leave this one for dealing with the data loss in the underlying system.