FireFox checks with Google services to check for deceptive sites. Having an outdated version of Roundcube wouldn't trigger the warning. My guess is that someone who sends usage data to Google got a spam message in Roundcube that triggered the warning.
While I would recommend updating Roundcube doing that alone wont fix the error, you need to get Google to remove the site from the deceptive site listings.