> If it syncs, that means that all my passwords are out in "the cloud" somewhere, which means I would be vulnerable everywhere all at once should that one master list ever be compromised.

For Firefox Sync, that entire list is encrypted using a client-side key in your browser, and the server has no access to the cleartext.