The downside is that Waterfox is based on Firefox ESR (Extended Support Release) builds, rather than the main Firefox branch.

ESR builds are actually less secure than regular Firefox because they receive security updates more slowly.

How accurate is this, exactly? I was under the impression that Firefox ESR is akin to something like the LTS Linux kernel. That is to say, sure, it doesn’t receive fancy new features as soon as they release, but surely it still receives important security updates in a timely manner.