To revoke the DigiNotar intermediate, a browser that has OCSP or CRL does not need an update. At least if it is formally revoked by Dutch state (which it isn't, AFAIK).
The updates are only required for root certificate revocations, apparently there is no OCSP or CRL for those (something that should be fixed).
But Mozilla is not distrusting the certificates based on revocation, but guided by the "CN=DigiNotar" in their issuer field.
That is why they need to upgrade the code.
In fact it is ugly, hardcoded exceptions for specific mishaps are being added to the software.
Something should be done that enables control of this kind of mishaps without having to update the software.
E.g. at work we have a Mozilla Seamonkey 2.0 deployment that I cannot yet upgrade to 2.3 because of bugs in that version and there are
no updates to 2.0 released anymore. Of course OCSP is enabled, but it would be better if it also worked for root certificates.