Orfox lists external apps when the user clicks and holds an Android URI in a WebPage
Even if the network.protocol-handler.external-default is false an user can open an external application.
When an user clicks and holds an Android URI[1] the browser context menu opens and if the android has an app with the same package id in the URI, the app is listed in the context menu allowing the user to click on it and open an external app.