An Open-Weight Model Turned Firefox Security Fixes Into Exploits. Your Patch Gap Is Now the Attack Surface