Not a panacea, but significantly minimizes the length of a theoretical breach.
Wish I had more time to spend on it.
A real problem I ran into is that a full browser is required for many operations, now. Instagram.com, for example, is completely opaque to non-DOM+JS browsers. Right down to the shamefully empty `<noscript>` block.
Please don't get me wrong, it would be great to have a service to centralize all your passwords including rotation, but this already exists. It's Google/Facebook if you choose to use oauth to sign in into other sites.
If this kind of api/js would exist and work, an attacker could exploit it to automatically change user's password.
Note that changing password is often used also as a simple mechanism to log out all the sessions (simple = easy to understand for the end user).
In summary, I really hope all website would do all they can do to protect their change password endpoints from automatic tools.
For me, passwords need to exist and need to be remembered, because if this is not the case, then many other security assumptions fail. With this I don't want to say that the current state of affairs is good, I definitely think that we need to invest in more mechanisms to help users remember their passwords, or reuse them in secure ways.
I’m not sure what you mean by “as well as your master”, though. If your master password is programmatically changed, how would you be able to access any of your stored passwords?