

The downside is that Waterfox is based on Firefox ESR (Extended Support Release) builds, rather than the main Firefox branch.
ESR builds are actually less secure than regular Firefox because they receive security updates more slowly.
How accurate is this, exactly? I was under the impression that Firefox ESR is akin to something like the LTS Linux kernel. That is to say, sure, it doesn’t receive fancy new features as soon as they release, but surely it still receives important security updates in a timely manner.
You say you’ve already read Librewolf’s FAQ, so I can skip over what they’ve provided in their response.
The only possible downside I could see would be that your encrypted data is stored on Mozilla servers. Which isn’t a very major downside–it’s properly end-to-end-encrypted. This is mentioned both by Mozilla themselves, as well as in the Librewolf docs. This is the only downside I can see right now, but for the paranoid, it might be worth looking toward the future; who knows, maybe some day, Firefox will randomly decide to disable E2EE for Firefox sync. That could be a potential downside down the road. But I find that to be pretty unrealistic… I honestly can’t see a lot of ways for Mozilla to screw this up.
If the prospect of relying on Mozilla servers still makes you uncomfortable, then you can self-host a sync server, but it’s not exactly a quick setup. They do provide a Docker method of installation, at least. The sync server code is found here, along with installation instructions for self-hosting and how to connect it to Firefox/Librewolf/other derivatives: https://github.com/mozilla-services/syncstorage-rs