Since the desktop files come directly from a package you'll need to change the package you're installing. This works best if you use the postPatch phase of symlinkJoin:

pkgs.symlinkJoin {
  inherit (pkgs.firefox) pname version;
  paths = [ pkgs.firefox ];
  postPatch = ''
    # String replacement example - will run the app in a terminal
    substituteInPlace "$out/share/applications/firefox.desktop" \
      --replace-fail "Terminal=false" "Terminal=true"
  '';
}

The reason for using symlinkJoin here is that it creates a package with the same outputs as the original Firefox, but with this bash script having run. You can use this like any other package:

let
  firefox' = <...>
in
{
  environment.systemPackages = [ firefox' ];
  # - or -
  programs.firefox.package = firefox';
}

Note that symlinkJoin has special handling for postPatch, but ignores all other stdenv phases, so you need to do everything in one bash script. You can use all the parameters for runCommand though, such as buildInputs and nativeBuildInputs - e.g. for compiling sass in a wrapper derivation.

In some cases it's useful to also inherit meta or passthru because it's used in some nixpkgs/nixos sanity checks, but it's usually not required.

Another approach would be to use overrideAttrs, which will also work but will cause Nix to rebuild the package from scratch. This might be fine or even desired in some cases, but you probably don't want to do that in this case.