I posted my thoughts on this over on Reddit the other day:
The cookies.sqlite database file is not encrypted, and its contents are not encrypted. In theory, the contents could be encrypted using a mechanism similar to the Primary Password used for logins saved in logins.json: you would provide the password once per session to allow Firefox to decrypt cookies coming out of the database and encrypt cookies going into the database. It sounds like it could be a drag on performance, and query whether this presumably low frequency attack justifies the precaution.
On the server side, if a cookie is suddenly presented from a different IP address, that ought to raise a red flag. In our era of mobility, I think web app designers don't want to inconvenience you by requiring you to sign in again when your IP address changes, but for highly sensitive apps, that probably would be a worthwhile setting.
https://www.reddit.com/r/firefox/comments/120t8bg/malware_which_steals_browser_info_session_tokens/
In the meantime, malware executing on your system outside of your targeted browsers can be blocked/defended in other ways. For more information on why the malware might not be detected by your antivirus, see: https://www.youtube.com/watch?v=nYdS3FIu3rI.
