It's not a backdoor, it just enabled Firefox's remote debugging tool by default, which is necessary if you want to modify the chrome of the browser on your own computer.
At the time it was in one of its first alpha, sure it was naive to ship a browser with it enabled because it was convenient for development, but it was fixed 1 week after the issue was raised, and has been for months.
They use the release candidate to test upcoming Firefox releases and see if it breaks anything, to be able to ship the update on the same day as FF (just like the majority of other forks do).
None of the patches they make require extra telemetry except for their "mod" system.
Most of the criticism Zen gets about "security" applies to every browser except librewolf and tor. Zen is as secure as firefox is.
All this is coming from someone who doesn't use Zen, as my workflow is constantly broken by their UI changes and bugs (which is the main problem with the browser).