I think backwards compatibility is the keyword here. That would be the biggest requirement to allow updates.

New bugs, and maybe for example new hardening policies needed, could be another one. Maybe a future firefox implements feature x and you want to / have to disable that.

But at the same time Firefox is the best example of upstream doing the versioning. They know when to freeze features and likely backport every security critical issue. Thats not the case with many other packages debian ships, where it just doesnt ship updates whatsoever.