A major action item here from Mozilla would be to bring this VPN under the same policies and teams that manage Firefox's security issues - or standardize the po

A major action item here from Mozilla would be to bring this VPN under the same policies and teams that manage Firefox's security issues - or standardize the policies across the company and ensure products are staffed for it (if there is a reason to avoid centralizing that to the team). I would never expect such poor handling from a browser vendor.