Given that any login form can be used to rapidly confirm password reuse it's hard to see how ECB introduces new issues here.
If the attacker doesn't have the valid password, the knowledge that two different sites share the same password isn't exactly game-changing. And if the attacker does have the password, they'll figure out where it works regardless of access to LastPass db.
To an outsider, hearing people talk about how LastPass used Very Bad ECB mode makes it sound like a fuckup with immediate and dramatic effect on the security of their passwords, that isn't exactly true.
Nobody should have been using LastPass, but we can still be realistic about the threats facing those who did.
> but the obvious problem here is the offline cracking of the vault passwords; this isn't worth arguing about.
Of course not, but that's a completely separate issue from their choice of AES mode.
Kind of a long shot though.
If you have some attacker after specifically you, yes this information is of less use to them, because they will have tried every password of yours they have on every website already hoping you reuse passwords.