All Firefox extensions can read the passwords if they're trojaned, regardless of whether they handle them or not.

Oh, no, I just meant that most forms with a password field are either log on or sign up forms, which I wouldn't want to bother with preserving locally.