The code that asks you the password comes from the server, and incredibly that's even for logging in to Firefox (and even many years after it's been introduced).

That means that the password and key can be obtained whenever a Mozilla server wants.

It's at this point impossible to believe it wasn't done like that on purpose (after pressure from someone); there's absolutely no reason to do and keep doing something like that other than to secure the ability to look at that data