According to the man page:
man 5 syslog.conf
it is possible to divert ipfw messages to a separate logfile by adding these lines to the configuration:
# Log ipfw messages without syncing after every message.
The result: All output of ipfw is logged to /var/log/security, but the above config lines are without effect.
This used to work on previous versions of FreeBSD, but does no longer seem to be true for 12.1-RELEASE.
I am unsure if functionality has changed and the documentation is now outdated or if the documentation is correct and this is a bug?