Would Mozilla blow one engineer's year's salary on such a thing though?
It's expensive, but it helps you land customers, which pay you enough to cover it.
Furthermore, I wouldn't underestimate the positive press that having a third party security firm assess your product and share the results publicly. VPN Services have been under special scrutiny lately so I think something like this makes total sense for Mozilla, regardless of the cost.
If throwing money at a problems solves, that's rarely a hard argument to make.
If you throw engineers at a problem it might get solved, or it might not. Hiring an engineer to work on something is a high risk investment.
side note: Mozilla does have great engineers, when I was there a few years ago the security was also very competent. But it's probably not the same as getting specialized consultants.
So this one off audit would have to hit them, say, 6000 extra 1 year subscriptions to pay itself off, let alone turn profit. Sounds like a stretch.
It would certainly be hard to measure.
On that note, how many customers do these public customer oriented VPNs have, typically? 1k's? 10k's? More?