> (If you don't use a master password, which isn't required, I believe?)
When using a cloud-synced password vault that lands on the servers of a third party (this includes Firefox, Google, 1Password, Lastpass, etc.) you must always assume that the file itself is compromised; the only thing between an attacker and your passwords is the encryption by your master key.
I seriously doubt that Firefox Lockbox will allow you to cloud-sync your password file without setting a master password. *
Note: One of the first things malware authors typically go for is the password vault stored in browsers, but this is only because it is commonly used without any master key set.
* It might depend on some key derived from your account password, if you haven't observed the requirement of a master key. Not sure.