As far as I can see (I'm not a developer), there is a package called "garuda-browser-settings", which includes between others this file, where the homepage is defined:
According to the PKGBUILD of that package, that file is copied into:
/usr/lib/firefox/browser/defaults/preferences/all-companyname.js
and this way this becomes a kind of standard Garuda configuration.
As far as I know, user preferences, such as the homepage, are stored in files inside the home directory (within the profile directory), so this should not be touched by those standard default configs, nor should be overwritten at firefox or garuda-browser-settings updates.
Configurations of course can be somehow "locked", and this is explained here:
https://wiki.archlinux.org/title/Firefox#Settings_storage
but I haven't found traces of those system-wide configurations.
That's why I still believe that a possible firefox bug, resetting (some) user preferences with the system preferences, could take the values from that all-companyname.js above.