The default behavior in ESR-91 is different than the new download behavior, but it's also not vulnerable by default. But if you change ESR-91 to "Ask every time" the same bug exists there.
Bug 1765049 Comment 8 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
The default behavior in ESR-91 is different than the new download behavior and it's also not vulnerable **by default**. But if you change ESR-91 to "Ask every time" the same bug exists there.