Can it? You can set an additional password for synchronization. I was under the impression this implies end-to-end encryption.
Of course, Chrome might send this data back to Google once synced and decrypted by the user. But Mozilla might do that just the same.
Given the approximately same setup and use-case: Who do you trust more to keep encryption strong and unbroken?
OFC trustless verification and such would be my ideal for a very impractical version of "ideal". Where I'd run my own server software, read all it's source code, read all the source code of the client, monitor all my network traffic, and do so for all updates. Given this is unattainable for me (for one: I lack the skills to really vet encryption software), I'll revert to a more practical "I trust Mozilla to at least try and implement secure and proper encryption and to be open about it".