Yes, it has access to the internal storage mechanisms of the browser.

I used to use Cookie Auto Delete for years. But when I last checked it seemed unmaintained. I log out of all somewhat important services anyway every time I am done.

For important stuff like banking I use Firefox containers.

Yeah, all of them could have their weaknesses and vulnerabilities. I just hope no attacker hits exactly the stack I use...

Personally I only open Firefox on Linux booted from a read only usb. In theory there could be a firmware vulnerability in the CPU that could let it write persistent data to the UEFI firmware, but I hope the possibility is small.