Former Firefox developer here. The reason for omitting tests is because they are essentially the exploits themselves; omission raises the barrier to entry, as

Former Firefox developer here. The reason for omitting tests is because they are essentially the exploits themselves; omission raises the barrier to entry, as somebody has to be skilled enough to craft an exploit based on the source code change. While security fixes are typically pushed out on all supported branches within a very short window of time, anything that buys time is useful imho.