Only if the attacker is already running arbitrary code with access to the userdata, in which case youre screwed anyways. Such an attacker could simply log keypresses, or wait in the background for firefox's keystore to unlock, he has full access. Trying to defend against arbitrary code running in the user context is really not in the scope of what a browser should be doing.
Hell no! the simple usecase is most of the time, leaving a comp. unattended happens many a time. It is not always computers are locked. This is not about Technicality of which code will be able to attack the keystore. this is a simple usecase scenario of somebody leaving his comp. unattended and someone snooping around. I'm sure browser cannot offload its guilt to the OS. Every piece of the system has to be secure. Juz because the OS is crappy, doesnot mean the browser needs to shitty too ! that is just a lame argument. Master password should be an option for sure.
Biology is the only science in which multiplication means the same thing as division.