True, sometimes. But they don’t have the sheer manpower dedicated to security that Mozilla has, nor the institutional policies that try to mitigate losing a key/account or something like that. Also, technically, vanilla Firefox is first to get the zero-day patches before they filter downstream.

Not that the forks are dangerous or anything, generally.