Not only that but this also enables offline attacking of the password. If you can compromise the Keybase server and grab the encrypted passwords, you can then attack it at your leisure with whatever computing power you can scrounge up, over whatever time duration you want. And when you break it, as long as any of the included devices are still on the account, you'd have complete access to everything.

Requiring existing devices to be actively involved in provisioning a new device prevents all of this.

Yes, but you can use 2-factor auth to control downloading the keystore, so in order to hack the person's account you need to already have physical possession of one of their devices and the master password (either to access their keystore or to get through 2FA).

And if it's not a 2FA device, the victim can use 2FA to push a disavowal of the old keys and set up new keys. That's an ugly and server-centric solution, but "halp I got hacked" is going to be an ugly case no matter what.

The way it works now is with SMS authentication which is not really secure at all.