Restic (local repo) which I sync onto a Hetzner Storagebox using rclone.

No. NoScript has more granular control over the different kinds of things that you can block per domain and is more similar to the now discontinued uMatrix in that regard.

This actually drastically decreases privacy and makes you more trackable. The best thing to do with your user agent is to set it to the most common one and leave it at that. Anything else (especially an ever-changing one) is a much more uniquely identifying piece of information.

Exhibit A: The Tor Browser, which focuses on maximizing privacy, is based on Firefox rather than Chromium. They upstream a lot of their major stuff to regular Firefox.

Exhibit B: Firefox therefore has privacy features that Chromium-based browsers just do not have, like first-party isolation or letterboxing for example.

Brave’s preconfiguration is a lot more private than Firefox out of the box, but hardened* Firefox is more private than Brave even with extra work put in.

*: Not just configuration (Arkenfox) but also patches. Like Librewolf (better) or Mullvad Browser (even better) or straight up Tor Browser (best).

Brave is more secure in terms of security. Security and safety are two entirely different attributes from a technical pov. And privacy and security are also not the same, though privacy is greatly impacted without security as you implied.

Firefox is more private than Brave but less secure. Neither is necessarily safer than the other, it depends on how much either app tends to misbehave within the constraints of your own use case. Since the use cases are different (privacy vs. security), it’s harder to compare safety on an even playing field.