They didn't "rebase" it though - just some code from Gecko was merged into it. And as I understand from https://www.palemoon.org/history.shtml, there were two merges - first with Firefox 38 ESR, and second with Firefox 52 ESR.

Thanks for the details! I was speaking from memory, but I see the last merge was quite a while ago. That somewhat increases my trust on the project then, although I'm not sure I'd ever trust a minor browser fork without further security assurances.