> - Why do the weird PBDKF2 derivation here? It's not based on a password the player enters, so there's nothing to "strengthen"? Seems oddly unnecessary (or I don't understand and there's a password somewhere).

If you set a master password, firefox uses that master password instead as input to PBKDF2.