They might be encrypted but that doesn't mean they can't be read, just be cautious that's all on what passwords you ask it to save.
I hadn't set a master password as the PC I use is in my own home and only I and my family use this PC but somehow a trojan got on it and it was only due to Comodo firewall, which alerted me to a particular request by a file wanting to connect to the Internet, that arose my suspicions.
I denied it access and looked at the origins of that file and found that it had created a folder on my C drive and within that folder were various "tools that turned out to be Firefox password / username "searching" utilities. There was also an 18 page txt file containing every username and password that I had ever used, along with the website that they were used for. Even my Payapl and ebay username and passwords were there - and yet they are used with a https site and so should not be saved with Firefox.! Goodness knows where the information would have been sent to if I had allowed it access to the Internet.
Antvir, which I paid for, did not spot the trojan but, as I then installed Kaspersky, it immediately recognised it and did its job of erradicating the problem. I have purchased that since.
For me I had been a little complacent and naive in believing that I was secure enough with Antvir and Comodo and not bothered about the likes of Superantispyware etc etc etc.