Not defending it but this was always a known, though not massively publicised, issue with the 1password format.
I seem to recall that the original justification was that it allowed for checking to see if 1p had a login for the current site without having to ask for your password to decrypt the db.
My understanding is that the new format addresses the issue, but it hasn't been rolled out to the dropbox sync yet.
Hopefully the noise here will push that ticket to the top of their priority list :)