Is this behavior expected? I would imagine it would be a privacy violation in a multi-user system. I thought they had some sort of encryption for hiding the sites that I visit.
BTW, FF does not do this on private mode. But still it is concerning, that any program can know about the sites I visit just by looking at ~/.mozilla/profile/storage/default.
I forgot to mention:
If you want/need to restrict processes that you run, you can, for example, use AppArmor or SELinux to restrict paths that they are allowed to access.
Or you use containers (Podman, Docker) to run low-privileged containers without access to your home directory.