If that was true, we'd expect to see forks like Pale Moon be _way_ more popular.
There's no reasonable chance that such a project could ever build a user base to register as even a blip on the market share graphs.
Some people avoid it precisely because of this doomed factor. Personally, I can't rely on nor trust that a project of that scale is able to navigate the security minefield that modern browsers are, and fix all the routinely discovered issues, let alone those that remain hidden and unreported. So choosing to use it is a conscious acknowledgement that you're sacrificing security for those other features, and very few people are willing to make that sacrifice.
The only way this can be true, but for Pale Moon and similar to have almost no userbase, is if the majority of people are leaving FF for lack of XUL support and going to Chrome/Safari, which makes little sense to me.