Not within a single application, usually. You get the application updated or not, but not 'just the security fixes' and the rest of the application stays the same, especially not with the likes of Firefox.

Even if you could force every app development company on the planet to support two-channel updates for "security only" and "everything else", How long would it take for them to force non-security related updates into the security channel through some vague justifications?