There might be ways to deduct that from total traffic/referral/… numbers without spying on individual users.

Not unlike how they (roughly) deduct deaths by an epidemic from peaks in deaths compared to averages.

By default the browser checks for available updates, whether for the browser or the add-ons (in the latter case, it's most probable that at least one installed add-on is hosted in the Pale Moon add-ons site). There's also the sync service, and default start page at start.palemoon.org. You can probably gather some stats from those sources.