Here are some ways LastPass has already leaked vault contents:

- It turns out a lot of the vault isn’t actually encrypted

- Some vaults used weak, breakable encryption

- The browser extension could be tricked into decrypting data for malicious parties

Encryption isn’t an on/off thing, it’s only as good as its implementation.

Also, this isn’t “zero knowledge” encryption, it’s end to end encryption.