It was enabled due that zen was still a toy project and we needed people to easily open the debugger for easier bug fixing. This was due because zen was not in a daily drivable state and didn't gain any sort of popularity yet
As the dev says in the PR almost nobody was using the browser at that point. To be able to interact with the debugging server you would need to have a port open on your firewall and router. And you would need to manually start the dev server. The problem in the PR is it was not prompting the user when launching the debug server and user could turn on the debugger without touching about:config flags.
The second part is more questioning, though not exploitable without the user clicking 2 times on a security warnings. I just checked their github to see if there is an issue/pr on the subject and there is none. Might be worth making one.
OciContainers just added rootless mode for podman. I was planning on playing a bit more with it but I'm quite busy and haven't fount the time recently. For the time being I run everything as rootfull since I don't expose stuff directly through the internet.
I might repond here if I don't forget once I've experimented a bit more.