You don't say which version of Debian you are using. Also note that can use Mozilla's own repository instead of a tarball.
The tarball from Mozilla does not have dependencies with xulrunner nor libmozjs packages; you can, in fact uninstall them both without breaking any dependencies (unless you also have Iceweasel installed).
Whenever you are getting security updates, they come from Mozilla, not Debian.