It's a denial of service vulnerability. Requiring the existing master password to change the master password will stop a drive by miscreant denying you access to your db. And password change system I've ever used has required the existing password to he entered first.

Likewise a full db export feel like a big enough deal to require authorization.

If you're careful and lock your machine when you leave it then you should be pretty safe. I'm surprised these aren't already features.