If you don't trust upstream why are you running their code?

I don't think it's reasonable for such a small group of people as Debian developers (or any other maintainers) to review each change looking for potentially malicious code. Especially in codebases as big as Firefox.