A set of instructions that would allow the end user to build something cannot be subject to any copyright license insofar as it doesn't actually contain the software that is bound by said license.

The unofficial patches are presumably by definition not copyright the project considering they are written by a third party.

This is kind of how multiple source based packages work. Nothing is being distributed by the repo save instructions the end user does the fetching and building.

Normally people do a small amount of research before attacking volunteers who are providing free labor to make their package more broadly available.

An example dialog could have been opened like so.

"We at the Pale Moon project prefer that distributions package as close as possible to the default experience to ensure that all users have the same experience and aid in troubleshooting. Can we talk about the patches that are being distributed with Pale Moon to see if they are really needed for our product to work on your OS?"

If no agreement can ultimately be reached respectfully ask for it not to be distributed but use the know how generated to add a forum post "Building on OpenBSD" not burning any bridges AND actually profiting from the experience.

Instead Pale Moon devs appear to have learned nothing from the interaction.

I've noticed that you didn't bother to address the technical reasons whatsoever. Your browser is probably the best vector into your system and malware no longer just screws up your system. It's now common for malware to encrypt your files and hold them for ransom.

In effect an out of date firefox means that malware authors can use up to date firefox's security fixes to target users using old software that perforce is vulnerable to the same attacks. This needn't be specifically targeted at JUST palemoon users. All users of out of date firefox represent a possible victim pool with attractively low security.