Debian Stable actually updates Firefox ESR through the typically on by default security channel.

The current ESR version in there is 128, which is about a year old, which replaced the 115 that came with Debian 12 by default.

The newest ESR, 140 just came out 2 weeks ago. 128 still has 2 months of security updates, and 140 has already been packaged for sid. I have no doubts 140 will come before those 2 months are up.

Now the KDE thing actually sounds like it sucks.