When I find stuff like this that uses SHA256, I instantly just tune out. SHA256 is stupid. Use SHA512 or find another line of work. SHA512 is astronomically more secure. Anyone who is using anything less than SHA512 for hashing is an idiot.
Just so you know: SHA1 is problematic because of potential collision attacks. So you should definitely not use SHA1 for signing anything because it might be possible to construct a different document with the same signature. That's it.
What does it have to do with password derivation? Nothing at all. Collision attacks are irrelevant, what matters is computational complexity. So if you use PBKDF2-HMAC-SHA1 the only thing that would make your solution less secure is some shortcut allowing to compute a SHA1 hash radically faster without throwing faster hardware at it. And so far nobody found one.
Since you seem to like name calling, what do you call somebody making authoritative statements on matters they don't understand?
For reference, I am the author of Easy Passwords extension which uses a concept similar to LessPass. And it also uses SHA1 - for technical reasons.