I don't really care about "promises" and contracts made between faceless corporations. I have no reason to trust Cloudflare or modern Mozilla, neither have I a reason to believe Mozilla would litigate against a breach of contract publicly instead of settling privately and secretly to prevent public outrage.
What do you think damages would be if you violate a contract with Mozilla that puts millions of users at risk? (I wouldn't want to test that)
And won't they get caught during audits? Or at least risk it.