yeah.. this is the main reason why with #rusticl my policy basically is "I use at most whatever FireFox ESR needs", because FireFox ESR is something every distro has to build and package unless they want to risk an insecure web browser.