I am not sure that I agree. It's hard for me to say where the responsibility for disclosure lies, but if I was Mozilla I'd need to find a good reason not to disclose such a vulnerability to the project owner/development team.

I am not sure that being asked not to disclose is a good enough reason without further justification; in fact it seems like a poor reason to me. Mozilla is in my view kind of a shepherd for internet users and I'd hope they'd fall more on the side of "let's not let our users get owned unnecessarily" than that of "let's sit on this vulnerability just because the disclosing party asked us to."