I know you ask this question in jest but basically it cascades, e.g. if I trust Debian or F-Droid, then I trust that the applications they include in their distribution or store is both secure enough (no piece of software is perfectly secure) and actually does what it say it does. In turn I believe they do the same, namely that initially when an application is added to their collection, they do review the application and the code yes. Then each update is only a gradual check, if ever done, assuming nothing special happened, e.g. no main maintainer change. If it's far from perfect, and as somebody linked else there are limits (e.g. https://en.wikipedia.org/wiki/XZ_Utils_backdoor ) but in "normal" situations it's enough for me.

Anyway that's just my perspective on the matter, on your problem specifically after a brief ~5min search I haven't found exactly what you are looking for but here are still some examples of what I do find helpful :

• IMHO very close but limited to Android https://reports.exodus-privacy.eu.org/en/reports/org.mozilla.firefox/latest/ and only technical, not about the "business" side, still it shows what is potentially collected and thus sold back
• example of 3rd party security audit on the accounts part of Firefox https://blog.mozilla.org/security/2017/07/18/web-service-audits-firefox-accounts/
• some publication from that 3rd party https://cure53.de/#publications-2024 but not specific to Firefox
• what Mozilla itself sponsored in terms of auditing other open source software https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed

Those though are mostly around security. They are definitely linked to privacy but still distinct. If I genuinely cared about the topic I would directly ask if organizations, non-profits, etc do think about the topic, e.g. Access Now, EFF, Exodus Privacy.

If by any chance you do find something helpful there please do share back.