The Firefox ESR branch is on the same release schedule as the Firefox 'Stable' branch. So, you get a scheduled release every 6 weeks. But ESR just gets the security fixes whereas Stable also gets the new features. When there's an out-of-band security update on Stable (a .1 release), ESR gets that, too. ESR is pegged to specific releases of Stable and operates in parallel for a few releases so there are two different ESRs... the older one and the newer one... so organizations can transition from one browser engine to the next over a couple month timespan and ensure corporate apps work on both.
Oddly, some non-organization people want ESR because they think it's updated less often. It's not.
Pretty sure they back port security/bug fixes as I have to keep updating it.