It's only a problem if your time is valuable and you are interested in running a reasonably secure box.

My time is way too valuable to be used to read bugtraq and hunt down security patches for every piece of custom software I have installed on my box. Or, as is the case, hundreds of boxes.

Firefox has an alert mechanism. If there's an update, that alert mechanism sends you to firefox.com, you get a new package for your OS.

This already works for .exe and .dmg versions, there is nothing stopping it from also working for the .dpkg and .rpm versions.

If you're running as a user with administrative privileges, as I believe I already pointed out. Our users don't, since they run on multi-user boxes.

If you had the permission to install the package in the first place, you have the permission to update it.

In locked down environmentsthat case, the admins can supply the nice properly packaged MSI / dmg / rpm / dpkg version that Firefox provides to the users via their deployment tool.

Our users didn't install Firefox in the first place. We did. And we have to update it. It's damn annoying.