Also it’s not clear that the same AES key is used for all secrets. If it’s URL- or tag-derived using the master password then it’s only bad for long secrets (more than 32 bytes) that aren’t random data.