For folks using stock Ubuntu, those mystery upgrades are likely coming from the -security pocket of the Ubuntu repositories. Security upgrades are pushed via Unattended Upgrades (enabled by default), and installed in the background without you seeing it.
That's an Ubuntu mechanism, not a Firefox built-in updater.
The easy way to check is to review your /var/log/unattended-upgrades/unattended-upgrades.log.
Here's an example of checking that log. You can see that firefox was silently upgraded in the background on June 17 and again on June 19:
$ grep firefox /var/log/unattended-upgrades/unattended-upgrades.log
2019-06-17 06:47:06,836 INFO Packages that will be upgraded: [...] firefox firefox-locale-en [...]
2019-06-19 11:49:03,299 INFO Packages that will be upgraded: firefox firefox-locale-en [...]
Here's an example of Firefox packages currently available in the various pockets of the 19.04 Ubuntu repositories:
$ apt-cache madison firefox
firefox | 67.0.3+build1-0ubuntu0.19.04.1 | http://us.archive.ubuntu.com/ubuntu disco-updates/main amd64 Packages
firefox | 67.0.3+build1-0ubuntu0.19.04.1 | http://security.ubuntu.com/ubuntu disco-security/main amd64 Packages
firefox | 66.0.3+build1-0ubuntu1 | http://us.archive.ubuntu.com/ubuntu disco/main amd64 Packages
Let's break that down a bit:
- disco/main: 66.0.3 (original, not updated)
- disco-updates: 67.0.3 (via Software Center or Software Updater)
- disco-security: 67.0.3 (via Unattended Upgrades, Software Center, or Software Updater)
It's not unusual for both -updates and -security to both be pushing the same package. After that, it's a race: If Software Updater runs first, you will see the Firefox upgrade listed. If Unattended Updates runs first, then you won't.
If you really want to see ALL upgrades, then you must disable Unattended Upgrades. I tried that for a few weeks long ago, and it was terribly dull. I soon re-enabled Unattended Upgrades. It's a good learning experience. If you try it, remember to run apt-update/upgrade daily to stay on top of newly-disclosed security vulnerabilities.