Is there a specific reason that Firefox is considered low-risk for a rug pull? In my view, Mozilla doesn't seem the same as it once was but maybe there are specific reasons the open-sourceness isn't in jeopardy.
Firefox scores well because it uses a copyleft license and the ability to relicense contributions remains with the original authors. Mozilla can't unilaterally relicense the Firefox code base as they haven't been granted that ability by the contributors. The copyleft license means they can't slap a new license on top (like a permissive license allows).
The rating criteria was designed to consider legal facators, like license terms and CLA, so concerns like Mozilla buying an ad company aren't factored in. Those concerns feel more subjective to me, but are certainly valid.
I imagine Firefox would die instantly if it moved to a restrictive license. It would be too easy to simply switch to a popular fork, and Firefox's userbase are the type that would be compelled to follow through with it. Even ignoring FOSS principles reasons, most folks are browser-savvy enough to understand the implications of such news -- their favorite browser is about to kill itself so they have to pick another one.
Also consider that Firefox would no longer be the default browser in most Linux distros, and likely prohibited from official package repositories entirely.
