User has to initiate to create a bookmark. And if your using the Admin/Owner account when going to sites they are given permission automatically to add as well-this can happen more then user think. Browser doesn't add something unless the user does this action.

Yes, Absolutely it is possible.

Look into "NoScript Security Suite" addon to prevent sites running malicious scripts that can do things like add bookmarks, trackers and addons, it does take a little getting used to but it's a very powerfull tool for helping to protect yourself online.