The issue with pretty much all of these security audits is that they typically are limited to code audits of desktop or server software.

Much of the security of VPNs though depends on the configuration of the servers/endpoints. Does it keep logs (on purpose or accidentally), are logs/traces of connections wiped from the RAM as well when you disconnect ... So even if you VPN client is perfectly secure, if someone is listening on the server nothing matters. Importantly, it's probably not unlikely that they were even set up by a "subcontractor" so even if Mozilla does everything right, there is the chance that a subcontractor still made a mistake and logs are being saved for example.

So a proper security audit would do lots of spotchecks on servers to see how well they are configured.

A proper security