No, I am making the assumption that I can secure my own VPN better than Mozilla can secure their instance of Sync.
From Mozilla? Absolutely.
How likely is a scenario where Mozilla abuses their access to the stored data on the sync service but not their ability to ship code in the browser? It seems unlikely for that to have much practical benefit.