In short I'm wondering what's stopping someone with access to my computer account to exploit an open Firefox Sync session to view my synced passwords, even if a Master Password has been set.
On this page Mozilla says:
Even though the Password Manager stores your usernames and passwords on your hard drive in an encrypted format, someone with access to your computer user profile can still see or use them. The Use a Master Password to protect stored logins and passwords article shows you how to prevent this and keep you protected in the event your computer is lost or stolen.
In other words, the Master Password is presented as a solution for protecting my passwords even if someone has access to my computer user profile. One example of giving others access to my computer user profile would be if I had a weak or no password for my Windows user account, and then lost the computer, if I understand correctly.
When I have Firefox Sync enabled and I'm logged in, but don't have a Master Password set, I can freely enable and disable syncing my passwords from Mozilla's servers. It's basically a checkbox that allows me to download my passwords whenever I want, and the passwords are immediately viewable as long as I am logged into my Windows user account.
The Sync and Master Password are presented as being fairly independent features, which leads me to my question: since the Master Password is local to my machine, aren't my passwords requested in the same way from Mozilla's servers as if the Master Password had not been set? If so, then how does the Master Password protect my synced passwords from people with access to my computer user profile if those people already have access to my Firefox Sync session?
Is the Sync session's credentials now protected with the Master Password as well? Sorry if the answer is obvious, it isn't immediately apparent to me from my day to day use of Firefox.