You have to take a couple things into account.
1. FF is a product, meaning if Chrome or Opera or Safari have some shiny features that a lot of developers enjoy to have, FF will very likely implement that feature.
2. Some new features are to replace the old one. For example, the original Firefox sync was pain in the ass and so there will be a new thing called Firefox Account. That's a new feature to user but it's easier to use and makes more sense to users.
3. Some new shiny features are there because of requests. People requested them and developers thought they were useful for users to have. That's inevitable. Unlike Windows, unless you cry to TechCrunch, MS won't care about your email because it's one of the 1000000 emails they receive every day.
In reality, software can't stay in the way the old OS works. Granted, we take Android fun as they roll out new features. But we can't upgrade easily because the phone manufacture and/or the service provider does not provide the stock upgrade (at least this is how my shitty phone works).
I know there are compatibility breakage and some UI decisions are really really bad. For instance, the latest nightly rolls out a different color scheme for web console which I find a huge problem for people with poor eye sight (me) or work long hours. The UI is changing to australis soon (maybe 29, maybe 30, don't remember, they haven't have a final decision yet).
It is actually quite frustrating to work in the browser side. A line of change can impact millions of websites. Often time you have to make a complex patch to make simple adjustment.
Regarding security vulnerability, I personally think they are minor compare to other more common, cheap threats. They are exploitable (and yes some are critical and severe) but when was the last time you find yourself exploited because of browser? It was probably you downloading an infected file. I know this is kind of unethical to say, but I think it is fair to say browser is quite secure these days and attackers are more likely to do things like clickjacking.
I don't remember if Firefox rolls out update (not upgrade) that includes vulnerability fixes or not. Someone correct me on this.