Mozilla <i>is</i> a vendor. Very few people get a Firefox rebuilt by a third party. (And, in fact, Mozilla takes steps to make that more cumbersome to do legally than just redistributing the upstream build.)<p>Linux is relatively unusual among security-sensitive free-software products in neither being a vendor nor wanting to be a vendor.