Sounds rather dicey, considering that the attack apparently depends on both the user using the "store master password" option, and the attacker having admin/roo

Sounds rather dicey, considering that the attack apparently depends on both the user using the "store master password" option, and the attacker having admin/root access to the user's computer. At that point, you might as well just install a keylogger, browser snooper, etc. I don't think this makes any progress on any of the real nightmare scenarios, like a bulk breach of LastPass servers plus some critical mistake allowing the master passwords to be cracked en-mass in less than a multi-decade timespan, or even a vulnerability allowing somebody capable of intercepting the traffic between a device and the LastPass server to get master password or cleartext vault data.