The security patches are largely from Mozilla's Gecko/SpiderMonkey/Toolkit work. The people who create the patches tend to be Mozilla employees. Looking over the 45.x Thunderbird releases I don't see a single Thunderbird specific security fix. [1]

The team that qualifies and does the release work for Thunderbird are volunteers. I believe that the builds are done on Mozilla hosted hardware.

[1] https://www.mozilla.org/en-US/security/advisories/