Because if you make it public too early, it gives some time for attackers to write exploit to target unpatched versions. Firefox is used in other projects, so

Because if you make it public too early, it gives some time for attackers to write exploit to target unpatched versions. Firefox is used in other projects, so the patch needs to spread, and time is needed.