Whatever question of legitimacy and security, this companion app is now the only way to make the add-on work properly. Feel free to bash Mozilla for that, not the add-on.
By the way, this companion app is both code-signed and open-sourced.