That's just their way of saying "we don't have to build this for you". They merge upstream changes, as long as the project is maintained you'll get those update

That's just their way of saying "we don't have to build this for you". They merge upstream changes, as long as the project is maintained you'll get those updates as they're released. Last I checked you can't sue Mozilla for a security vulnerability and the open source license has a clause about no warrant of merchantability or fitness for a particular purpose. They don't guarantee security either.