Firefox also installs telemetry and data reporting functions like most browsers, also libraries like libwebp, which are prone to critical vulnerabilities (as seen), encryption systems like Encrypted Client Hello, and software like Pocket, which some users never use, but it's still there.

Any browser will install many features that probably won't be used. Saying that a browser that installs a feature like Tor or VPN (which aren't even hidden, Brave publicly present those features) is automatically bad doesn't sound reasonable to me.