I apologize for not commenting more recently, but chromium-browser has been an alternative dependency in gnome-core since relatively soon after Antonio's comment.
I think Epiphany is not because the Debian Security team does not offer security support for webkit2gtk in Debian stable releases. There's a chance that could change for Debian 10 "Buster" and webkit2gtk is well-maintained in Debian Testing, so maybe it's worth reconsidering. As for the original bug here, I think the ordering of firefox-esr over firefox reflects the intent of the Debian Firefox maintainer. The firefox package is completely unsupported in Debian Testing (it won't receive any updates). I don't want someone to accidentally figure that out when they try to do an unsupported downgrade from Unstable to Testing. Thanks, Jeremy Bicha
