They're not using Mozilla's security fixes or browser engine. Pale Moon is a hard fork, so it is developed, and developed independently from Mozilla's Firefox.
They didn't "rebase" it though - just some code from Gecko was merged into it. And as I understand from https://www.palemoon.org/history.shtml, there were two merges - first with Firefox 38 ESR, and second with Firefox 52 ESR.
Thanks for the details! I was speaking from memory, but I see the last merge was quite a while ago. That somewhat increases my trust on the project then, although I'm not sure I'd ever trust a minor browser fork without further security assurances.
Also check out this page - https://www.palemoon.org/info.shtml.