Across multiple devices syncing with Firefox, user should be able to declare one device as "lead" (master, in old parlance) and any sync changes from other devices require approval (human user type) before the "lead" can be changed.
(I was messing around with setting up Firefox on a new Linux machine. Next thing I know all my other devices were sync'ed to the Linux machine, which contained ZERO passwords, bookmarks, etc. Fortunately, and strictly accidentally, another device was off line and I was able to use it to restore some semblance of order. That I had good data should not be left up to fate of a device being on or off line when a sync is being done.)