I'm not sure, but I still don't get it: didn't Firefox 3.08 fixed ~at least two security bugs?
I'm using NoScript plugin [maybe more security], but not all of my friends, who has Lenny uses NoScript, because they say the don't want to whitelist every new site :S