“In summary this asks Polkit to check whether the privileged Mozilla VPN D-Bus service itself is authorized to perform the action. Since The Mozilla VPN D-Bus service runs as root, this will always be true.”
The daemon asked whether root was allowed to do things as root. Any local user, even nobody, can configure a VPN, redirect traffic or fake a secure tunnel. SUSE reported it on May 4, Mozilla went quiet and then leaked the embargo itself in a GitHub PR. Mozilla’s first fix removed Polkit entirely and left every D-Bus API open to any local user.