My point is that I found I could enter my firefox sync password and my master-pw-protected passwords were brought down from firefox without any trouble, ergo by

My point is that I found I could enter my firefox sync password and my master-pw-protected passwords were brought down from firefox without any trouble, ergo bypassing my master-pw completely. My expected behaviour would be that the master-pw would be used to encrypt the passwords, and this encryption would be carried to the sync'ed passwords such that knowing my sync password would be insufficient alone to get my cleartext passwords - which is, afaik, how almost all other (online/syncable) password managers work.