Anyone can easily verify this by downloading the binaries, and running checksec themselves.
Here's the output:
$ sha256sum palemoon-bin
0b7f4ad73fc671e20bfb2366aa9d9ad81e82a3c8f63acde7f37063e73fda2141 palemoon-bin
$ checksec --file=./palemoon-bin --output=json --extended | jq
{
"./palemoon-bin": {
"relro": "partial",
"canary": "no",
"nx": "yes",
"pie": "no",
"clangcfi": "no",
"safestack": "no",
"rpath": "no",
"runpath": "no",
"symbols": "no",
"fortify_source": "no",
"fortified": "0",
"fortify-able": "15"
}
}
Notably, the binary has not been compiled with -fPIE and -fstack-protector, which disables two very basic exploit mitigations - ASLR and stack canaries. Any self-respecting Linux distribution enables these compiler flags by default nowadays. -D_FORTIFY_SOURCE is also missing, unlike Chrome or Firefox. A modern browser uses dozens of custom binary exploitation mitigations in addition to this.
Mitigations and sandboxing are the difference between an exploit a CTF player can write on an afternoon, and a multi-month expert-level endeavour.