> If you're using the automatic updating functionality (which the majority of people are) then it absolutely applies.

Which is why I don't get my updates via an automatic Mozilla updater, but rather via my distribution.

> The reality is that if you trust Mozilla to provide software updates then you can trust them to provide Javascript

As I indicate above, I don't trust them that much. You're right that the update problem and the JavaScript problem are identical.

Allowing pushed updates makes individual targeting far too easy for an adversary.