That is incorrect. Many bug reports are marked as private for security reasons.
Other decisions such as Pocket, Cliqz and Mr Robot are made and executed in private.
Once the code is thrown over the wall it's all open. Upstream of that is a different matter.
Maybe you don't know how this works. Most (almost all) employees do not have access to these bugs, either. But community members can and do have access.
Early access to these reports can be worth literally millions of dollars in the wrong hands, and cause much more damage to our users. However, who gets access isn't decided by who gets a paycheck. It's decided by who is involved and participating and trustworthy. That can be literally anybody.
For an open source project, Mozilla appears to constantly settle on pretty shitty partners if it is true (as is alleged) that it's these partners that insist on secret communication shielded from any community interaction.
Such shady deals in smoke-filled backrooms are one of the small number of things that are hard to impossible to pull off in a community-driven project without constantly pissing off contributors.
I am amazed that Mozilla has not yet released Pocket as free and open source software. What's going on?
FYI, I work at Mozilla but don't speak for Mozilla.