The eye button comes from the underlying Firefox platform on all password fields. We could look into trying to hide that after successful sync setup, but having it there is really more honest — you should generally assume that someone with access to your unlocked OS account has access to your passwords, unless they're in a locked password manager. There's no way Zotero sync credentials could be truly secure unless you were prompted for a password on every sync. And even then, someone with access to the computer could change the network/certificate settings and capture network traffic, inspect process memory, etc. Don't let people use your computer unless you trust them!