They claim that Rust and WASM is the answer. Their blog entry on the difficulty of passing Mozilla’s review for the Firefox extension suggests that they are taking things seriously, at least as far as reproduceable builds.

It wouldn’t hurt my feelings if they had someone actually on security detail. Maybe they do and just haven’t said so. Given all the problems with Flash, I would like to see them do more bragging and discussion on how they are dealing with security issues.