The point is that they forked an older version of Gecko and have been maintaining it with a small team ever since - and it still works reasonably well.

Is its security great? At least in the past they made great efforts to keep up with CVEs, but they don't pump it full of money and talented individuals - so I'm doubtful that the security is great. Is it actively exploited? I doubt anybody would bother.

Am I endorsing Pale Moon? No, but it's still an impressive effort even if I disagree with a lot of their choices.