It's worth noting that Debian backports security fixes for firefox-esr and these come in more often than once a year[0].

[0] https://www.debian.org/security/2019/