> We can run our own Firefox Account servers.
Which can themselves be compromised. The old Firefox Sync protocol was immune to remote compromise, completely and totally.
> People get annoyed of being told x-y-z is not secure, while not being offered any practical solution
I agree: the problem is that there was a practical solution: just keep the old Sync protocol.
> I'm assuming Firefox has a good reason for working the way it does
The short version is that people wanted to be able to only have one device and still get at their data, and Mozilla didn't want to confuse them by separating their account passwords and their sync passwords. Never mind that combining them has results in a wholesale loss of security.
People get annoyed of being told x-y-z is not secure, while not being offered any practical solution, especially if the risk/probability of attack is low.
(I'm assuming Firefox has a good reason for working the way it does, but I guess the first step would be to have more documentation about that.)