I'm not sure what you're saying here:
> (Hashed) Password storage is moved to a third-party database (the email provider)
There is no hashed password? It's just a challenge response using an alternative path.
In contrast, a password is designed to be used from any login point.
In this regime, unless the optional password is used, there is no hashed password stored on Mozilla's servers. Only a copy of the hash of the "login key" is stored, so the attack surface is considerably shrunk if you are attacking Webmaker users.
https://chrisdecairos.ca/one-time-passwords-pt-2/
I'm not totally clear about what the different between a "login key" (short-lived, pronounceable) and whatever is contained in these semi-permanent login email links (~1 year, presumably non-pronounceable).
[1]: http://notebook.ideapublic.org/wp-content/uploads/sites/5/20...
I don't see a difference in this and 'Reset your password' links in emails that are common place. They are basically the same premise, without the password.