Unless somebody installs malware you don't need to worry about a web site that you are browsing being able to access whats sent or stored by Thunderbird. However, you do need to be aware of the possibility of another tab/window in the browser using
cross-site scripting attacks etc. to read the password that you typed in the browser. Rather than trying to figure out who I can trust, I always close any other tabs/windows whenever I need to login in to a web site.
You should configure each account in Thunderbird to use a secure connection (SSL/TLS or StartTLS) to avoid sending a password in clear text over the Internet when it logs in to the mail server. Some ISPs don't support that. In that case I suggest you sign up for a Gmail account and use it instead. Its also safer to use SSL/TLS rather than StartTLS. StartTLS is used to upgrade a normal/insecure connection to a secure connection (everything sent or received on it is temporarily encrypted). If it does that there is no practical difference between the two. However, you are relying upon Thunderbird breaking the connection if it detects the upgrade failed (or that the mail server says it doesn't support StartTLS) to avoid ever sending the password in the clear. It is supposed to detect that (and has in the past) but there is always the chance of a regression bug or some developer deliberately changing the behavior without you knowing it. So, if you have the option, always use SSL/TLS instead.
Thunderbird's new account wizard uses SSL/TLS for Gmail POP/IMAP accounts but uses StartTLS on port 587 for the SMTP server. However, Gmail does support using SSL/TLS on port 465 for the SMTP server.
