Whilst I'm aware that this isn't a complete answer, it may get you so far or possibly even make you rethink your methodology.
I'm not sure if you are aware that each end user can have multiple profiles and hence profile folders. In addition they can have those folders named however they like not just the *.default names, (which may not exist at all), and they can be in any location too.
There is however a method to determine those names and paths, because there is a file named profiles.ini
located in the %AppData%\Thunderbird
directory which defines that information.
What follows is an untested example script which should set variables to the available prefs.js files for a single user.
@Echo Off
Set "PF=%AppData%\Thunderbird\"
If Not Exist "%PF%" GoTo :EndIt
Set "i=0"
For /F "Tokens=1* Delims==" %%A In (
'FindStr/R "^Path=.*" "%PF%Profiles.ini"') Do (Set "TP=%%B"
Call :Sub "%%TP:/=\%%")
Set PJ[
:EndIt
Echo( Press any key to exit...
Timeout -1 1>Nul
Exit/B
:Sub
Set/A i+=1
If Exist "%PF%%~1\" (Set "PJ[%i%]=%PF%%~1\prefs.js"
) Else Set "PJ[%i%]=%~1\prefs.js"