Actually, master password changes require the decrypting and then re-encrypting of the entire database, done locally. Mobile javascript engines would die.
Because it has the amazing feature of storing all your passwords in a file. It's nothing like the features offered by lastpass with respect to serving you your passwords from a remote host and if you can't trust your password manager to KDF & encrypt then you really shouldn't be using it as it's doubtful it's properly generating secure passwords.
