You can’t get an OSS team to fix vulns in a meaningful amount of time, let alone research them. Waterfox/Palemoon stay months behind the official branch and are always vulnerable.