Well, I would argue that they are doing something wrong. You're absolutely right to say that there is no reason to do something other then just storing the key

Well, I would argue that they are doing something wrong. You're absolutely right to say that there is no reason to do something other then just storing the key locally (since someone who has local access to the key, can presumably access your entire dropbox already anyway). But as the original author points out, the fact that changing your dropbox password does not invalidate existing tokens is an issue.