And they don't explicitly warn their users in the App about how critical a strong master password is.

When I asked them to allow me to use a key along with my passphrase they said it would confuse their users, and then acknowledge their users aren't going to pick good passwords and would be at risk:

http://discussions.agilebits.com/discussion/comment/25737/#C...

> A master password constructed with diceware of three or four words should be both strong and memorable, but I have to acknowledge that most users aren't going to use diceware to construct a master password. So I suppose that your point stands.