The biggest threat to most users is that their password on SomeRandomSite gets out (db dump, hacked, whatever) and since they use the same password everywhere, now their bank and/or their email password is out in the wild. If you are willing to carry an encrypted password file around with you, and consult it every time you need to enter a password, go for it. Yes, that is more secure than LastPass. What LastPass offers is balance between convenience and security.

Also, I believe that a hacker who gained access to LastPass's database would merely get a bunch of encrypted passwords. LastPass doesn't know your master vault password, which is needed to unlock your vault and use the passwords that are stored there. So, they are a big target, but primarily for attacks like this where an individual page might be able to hijack the plugin for users visiting the site, and not because some could hack LastPass and get everyone's passwords.