Hi Wolfman,
I could give you my experience and qualifications, including professional expertise in "unix" kernel internals and having taught sysadmin to computer science students (not IT persons), but that is not the matter of interest. In practical terms, it is that I do not use Thunderbird, Firefox, or Seamonkey from any distro -- I use the production current release from the original provider for the environment and platform I need. These applications under Help -> About show an update box when an update (from the provider, not repackaged/rebuild by a distro) is available. As an ordinary user, this "box" no longer prompts for the admin password, but refuses to update. However, if I login as root to a GUI window session (e.g., using MATE), the update box becomes active, and the update is performed for all accounts. Clean and simple. If the system would allow provider versions (as I use) to update from a user account with authentication, I would do that. Does this help?