Keys in secring.gpg are encrypted using the symmetric key, derived from some password. Key derivation function is called S2K and is described in RFC 4880. Basically, it iteratively hashes the password plus some random salt.

To get the details about exact algorithms and iterations, you may run gpg --list-packets ~/Library/Thunderbird/Profiles/zzzzzz.default-release/secring.gpg (or rnp --list-packets ..., if you have one installed).

For my secring it reports AES-256, SHA-256, and 35651584 iterations which looks quite enough for the secret key protection: single password try would require to hash 35 * (password_len + 8) megabytes, i.e. around 500MB even for 8-chars password. Googling the modern hashing speed return 2-3GB/sec for SHA256, so it would give around 5-6 password attempts per second.

Keys in secring.gpg are encrypted using the symmetric key, derived from some password. Key derivation function is called S2K and is described in RFC 4880. Basically, it iteratively hashes the password plus some random salt.

To get the details about exact algorithms and iterations, you may run gpg --list-packets ~/Library/Thunderbird/Profiles/zzzzzz.default-release/secring.gpg (or rnp --list-packets ..., if you have one installed).

For my secring it reports AES-256, SHA-256, and 35651584 iterations which looks quite enough for the secret key protection: for a single password try implementation must hash ~35MB of data, and then try a decryption. Googling the modern hashing speed return 2-3GB/sec for SHA256, so it would give around 80 password attempts per second.

Update: edited answer to clarify OpenPGP S2K iterations count: it is actually number of bytes hashed, not the number of times hash is applied to password/salt.