how are they supposed to “sell your data”

First step is collecting it. Putting provisions to grab everything from the software you installed on your device and use to do everything is a good start. Second step is selling it. Data broker loves data, surprisingly. And even small, inconsequential stuff can go a long way when you can correlate with dozens, or hundreds, of data points.

if you just never use a Mozilla account

Given how it’s implemented, the data pushed inside your account may be in a safer place than what you use the browser to do daily at this point.

and uncheck all the telemetry

Funny thing. Even with everything unchecked/disabled/toggled off/whatever, there’s a handful of ping back and other small reports that are configured to go out. You can turn these off using the complete config page; the one that warns people that its dangerous and have no clear way to know what most of its options do.

Its not like they can secretly steal your data, since its Open Source

If by “secretly” you mean without us knowing, it would be hard indeed, as long as people did look into the source AND the built images were faithful to the source, too. They are not doing it secretly, at least for now, anyway. That’s the point of their “privacy notice” that includes basically everything, which they then use as a safeguard saying "we can’t do shit (unless specified in the privacy notice).

It seems to me like just more FUD that Google is spreading to undermine our trust in free software

The policy changes comes from Mozilla. Were written, published, and updated by Mozilla, on their blog (and legal pages). What the fuck are you talking about with Google?

Heck, if you knew 2cts about this, Google actually low-key needs Firefox to exists as a counterpoint to Chrome’s hegemony, unless they want another trial for being too good at their job.