For things that MoCo has done like this (e.g. Kodak, Ebay) a “repack” is done – unpack the official build, copy the extension(s) into the extensions/ dir, then repackage the build.

As Firefox checks for updates, the “risk of installing outdated software” probably isn’t too terrible, but you can run into problems with installing the extension to the application directory (for example the extension manager does not make sure that the user is running as administrator).

I think it’d be easier to write a simple extension for Firefox 2 that is able to do what you describe; that is, download and install the latest version of the extensions into the user’s profile (so you won’t run into future update problems), and bundle that with the repack. I wouldn’t worry about a slightly out-of-date Firefox as it’ll update itself. If it’s a big enough concern, maybe this same extension could trigger the update check on startup?

In any case, Cory needs to talk to Mozilla if he wants to distribute anything but the standard build under the name “Firefox” (see http://www.mozilla.org/foundation/trademarks/policy.html). That’d probably be a good way to get advice on the right way to do this, as well.