This has been an on-going problem for me.
setting:
security.allow_eval_in_parent_process
to true seemed to fix it, for some reason
signon.management.page.fileImport.enabled
was already set to true when I checked it.

I’m not sure why -and I don’t care since I am able to import my passwords.

In summary, what fixed my situation was:
signon.management.page.fileImport.enabled TRUE <<to allow importing
security.allow_eval_in_parent_process TRUE <<to coax firefox into actually reading the bloody CSV file.

After doing that, signon.management.page.fileImport.enabled had been set to true, but that may be a local (to me) thing and folks ought to probably check it anyway.

Thanks, @aevsolaev!