Windows releases are signed using Authenticode, so the signature is embedded into the executable and the OS automatically verifies it upon launch against a Microsoft-maintained list of X.509 certificate authorities. The individual files extracted into 'C:\Program Files' are likewise Authenticode-signed when possible.
You can view the signature details in the file's "Properties" window, or using sigcheck (from Sysinternals), or using Get-AuthenticodeSignature (PowerShell cmdlet), or using signtool verify (part of Windows developer kit), or using osslsigncode verify (available in many Linux distributions).
Linux releases (source and pre-compiled) are signed using PGP, with a detached signature being available at the same URL + .asc suffix. They're at
https://ftp.mozilla.org/pub/firefox/releases/:
(Mozilla's "Downloading the source code" article points to https://archive.mozilla.org, but that is basically the same server with the same contents.)
Of course, for PGP to be useful at all, you need to find some other way to verify the signing key instead of just grabbing it from the same directory. It seems Mozilla publishes their release keys on their blog.
As long as you're dealing with single files, a separate "SUMS" manifest is basically redundant – it only adds several extra steps for verification while doing nothing for the actual security. You get exactly the same value from verifying a signature made directly against the file that you wanted to verify.
Nevertheless, the Mozilla FTP server does include SHA256SUMS manifests containing every file belonging to the release (including Windows and macOS), together with a PGP signature.
