> and the only two ways to turn it off involve going into about:config, which most people don't even know exists.

There's a third way according to the feature's development documentation [0]: uncheck "Options"/"Preferences" -> "Security" -> "Block reported attack sites".

[0]: https://wiki.mozilla.org/Security/Features/Application_Reput...