After you create your Firefox account, your password is used to create a key that is stored locally in your Firefox profile folder. This key is used to encrypt the passwords before they are sent to the Mozilla services servers. So the passwords should be unreadably encrypted both in transit to and from, and while stored on Mozilla's servers.

However, that password is the key to it all -- if someone can guess your login credentials, then they can get your passwords. If/when you set up Sync to the same account on another device, when the other Firefox gets the passwords, they are stored locally in their original, readable form. On your own devices, you can create a Master Password on each device to secure them from prying eyes, but this doesn't transfer between devices or to new Sync connections.