> Or to separate security updates from feature updates, but I think this ship has long sailed for modern browsers.

That would be my preferred solution. But yes, as you say, that ship has sailed. No reason why it couldn't sail back though.

The goal is to fully control your environment and not to expecting some unexpected updates.

User is the one who must choose update policy. If user is choosing to not update then it's their own problem and no manufacturer has the right to deside otherwise.

In the case of Firefox, there's also the Extended Support Release. Security updates without the UI change every 4 weeks

https://support.mozilla.org/en-US/kb/switch-to-firefox-exten...

My browser isn't supposed to have any 'backend services'. Especially not backend services that I did not explicitly opt in to.

Good question. Because for security reasons you want to stay up-to-date on software that connects to various websites. At the same time, from a functionality point of view I wished I'd never have to update anything.

I was surprised to find I had telemetry enabled. I could have sworn I disabled it, but it would have been a long time ago, so I was thinking maybe I remember it wrong.

I would like to see any source that may exist on it having been silently re-enabled. I know telemetry is anonymized and totally harmless or whatever, but re-enabling it behind my back would feel like such a breach of trust.

It was re-enabled for me as well. browser.crashReports.unsubmittedCheck.autoSubmit2 and datareporting.healthreport.uploadEnabled

It didn't re-enable for me.