Its not that scary because their patch sets form part of several other browser forks (ie cachybrowser but also several others) so they get a decent amount of scrutiny

I have no idea how random the librewolf maintainers are but the next iteration raising the bar for high-impact open source projects should definitely have a checkbox for "has a key maintainer with a active public profile/streetcred in industry" on the checklist.