If security is such a hot button worry wart issue, then it shouldn't be permissible for Mozilla developers to bind minor UI tweaks to security fixes. Firefox user interface changes should not be tightly coupled with essential security updates, since they introduce the hazard of many users refusing to comply with good security practices, simply because some asshole design wonk decided to enforce their tastes upon millions of users and disrupt existing, productive, habitual user interface behavior.
And by the way, it's absolutely possible to securely run an instance of Firefox 28 in a read-only, sandboxed, firewalled VM, restricted to connecting to specific trusted hosts.
Permitting a third party to control and modify your behavior by enforcing automatic updates in a manner that does not match your schedule can be an insidious security hazard unto itself. Organizations like Mozilla, Google, Apple and Microsoft have no interest in and no concept of what might be hugely disruptive to their end users, nor do they necessarily have any concept of a given environment's actual security posture. They simply cry "security" and then rampage all over everyone's shit with righteous entitlement.
Nope. I define my security practices (including whether I run a javascript-enabled browser at all), and I define my update schedule.