There's no mention of IE because of their selection criteria (cannot be resolved by automated fix, eg windows update, but has to be resolved/patched by the end user)
Part of the issue here is that it's aimed at network managers, so they are looking at programs with vunerabilties that the network manager can't easily resolve, and Firefox isn't aimed at that market particularly.
I wonder why they don't consider Firefox's auto update feature to be automated?