Comment by L_Rahman

They did encrypt the vaults. The problem is that for accounts that were opened before 2017 the used an encryption algorithm that can be cracked with modern hardware. Not a typical desktop GPU, but someone with some firepower could pick an account and crack the master password in a reasonable length of time (on the order of weeks/months).