I'm sort of suprised Mozilla pulled the 16 release. The vulnerability doesn't seem that great to me; reading the Ars Technica report, it seems like all it can do is examine URL redirection of another window. Not great, and it's good that they fixed it promptly, but pulling the release seems like overkill to me.
From the outside it looks like Mozilla generally sit on minor vulnerabilities and fix them in the next release - I'm not sure why this case should be any different (and I imagine it generated more negative press from clueless people.)