Luca found this while reviewing bug 1745820:
https://phabricator.services.mozilla.com/D144070#inline-796645

When an extension that was granted <all_urls> optional permission uses the browser.permissions api to request *://*/*, it will be granted without prompting because the second is subsumed by the first.

If it does it in the reversed order, it will prompt and can be granted two separate permissions that are both presented to users with the "Access to all your data" permission string.

This can already happen, though invisibly until bug 1745820, which can expose this (rare) state to users, and be confusing.

A solution might be that the permissions api drops the *://*/* optional permission when <all_urls> is granted.