Why, docker-initiated chroot would prevent FF from acessing any not-FF+libs files, including which this malware steals; on Qubes it would have access to everything user-readable in the AppVM, which may include some secrets as Qubes workflow involves user-supervised copying files across VMs.
Obviously docker, as opposed to Qubes, won't stop more complex malware that exploits the kernel.
Obviously docker, as opposed to Qubes, won't stop more complex malware that exploits the kernel.