In fact it seems that xdg-open _does_ search for firefox but has other
issues when trying to open a URL as root. In its man page it explicitly
advises against running as root, so I think it's really up to
apt-listbugs to honour that advice here.
A similar bug browsing menu in reportbugs's text UI works fine,
including the 'b' action to launch a browser, since it's run as a normal
user.
And to clarify I was referring to the case when apt-listbugs is run as
"/usr/sbin/apt-listbug apt" within the apt hook.