They've back-ported a lot of newer Firefox code where they could, but that leaves gaps, and they're still using code Mozilla hasn't supported in many years. The current SeaMonkey releases (2.53.x) are based on a (highly-patched/upgraded) fork of Firefox 56, which turns 5 years old tomorrow. Sadly, I doubt it's fully secure and it definitely isn't up-to-date. But I don't know how secure it is or if it's fully up to date. You could look into some forks like SeaMonkey. Moonchild has always waived his hands/paws at the security issues inherent in relying on Mozilla for security fixes when Pale Moon is using a ton of untested code that Mozilla removed years ago. I should point out that Tobin was/is an aggressively shitty person, so it may not be all bad.

They weren't keeping up with the modern web when they had Tobin, and there's no way this gets better without him. Tobin stormed off 6 months ago, and tried to nuke the project on the way out the door, so now there's one main dev and a few contributors. They never had the resources or expertise needed to maintain a competitive and secure browser, and an army of skilled volunteers failed to appear to help, so they filled all the gaps with FUD (' HTTP/3 is bad', ' Rust isn't strongly-typed', 'WebAssembly can run arbitrary code', etc.) and trudged on for 5 years.

They hated Mozilla's decision to remove XUL and thought they could build a better browser on their own. Pale Moon uses a hard fork of Firefox 56 because of the egos of its two main dev's (known as Moonchild and Tobin). Nobody should be recommending Pale Moon without providing a full disclosure of the significant risks that come with it.

Which browsers use chromium