“Accordingly, we’ve updated our bug bounty program to pay researchers for bypassing the sandbox even without a vulnerability in the isolated library.”
Firefox compiles five C libraries to WebAssembly and back to native code. A bug in the font shaper or the spell checker now stays inside its box. Mozilla is confident enough to pay for any escape. Most vendors ship C parsers raw and call it defense in depth.