Are there potential pitfalls of making the FMS database file accessible (read only) to regular users? There's lots of handy metadata in the SQLite database that I'd prefer not to duplicate by walking through 13000+ mp3s. Thanks.

Not at all. In fact, many third party tools out there talk directly to the sqlite database.

Its better to use sqlite3 though, as there are some bugs in sqlite2 and firefly (only svn-1696 iirc) concerning locks. With sqlite3 its all fine though.