Right now I'm thinking of this in terms of git rebase. Can the package manager in Firefox OS handle local backports upstream? Would an update to a given Firefox app wipe my changes automatically by default? Would an update to a given Firefox app never occur automatically by default because of my local changes?
In other words, if I edited the source of this app on my hypothetical Firefox OS, would I be damned for the rest of eternity to either upgrade manually, or wipe my local changes? The security risk I'm concerned about is "my software isn't up to date with the latest patches therefore it is at risk."