Once you get directly spearphished it changes your threat modeling, and in my case, you learn phrases like threat modeling.

> Firefox’s security is fine.

There is some debate about this which can be found surrounding my linked comment in OP.

They just patched two vulns as of time of writing. Don't assume a browser is bulletproof. Since a browser is so complex, bugs and vulns appear regularly in them and can exploited for months before a patch arrives.