> lags behind upstream Firefox in terms of security fixes

I’m not sure why this has become a thing - usually I either release Waterfox the week before ESR releases (the week the code freeze happens and new version gets tagged) or, if I’m actively working on features and they need to coincide with the next update I push, I will release on the same Tuesday the ESR releases.

You can check the GitHub tag history for Waterfox to see it’s been that way for a good while :)