It's a denial of service vulnerability. Requiring the existing master password to change the master password will stop a drive by miscreant denying you access to your db. And password change system I've ever used has required the existing password to he entered first.

Likewise a full db export feel like a big enough deal to require authorization.

If you're careful and lock your machine when you leave it then you should be pretty safe. I'm surprised these aren't already features.

There is of you click on the image.

On Jerboa(List View) the link is on the thumbail, maybe it's the same in the browser version. Keep in mind that the article on heise is in german.

there is.