Making brute-force attack the only possible option is a desired feature of a security system.
This "only" would mean there are no weaknesses in the algorithm or implementation and the system could be broken only by trying all combinations of possible passwords.
On top of making sure brute-force attack is the only possibly, it should also be made difficult to perform.
In case of LastPass' database (an offline, encrypted file) the countermeasures are limited, but both the system design and user have influence over the effectiveness of an attack.
First: the database is protected with a key derived from a password using PBKDF with a specified number of iterations, which increases the time required for confirming each guess attempt.
Users need to set the number of iterations of PBKDF high to the point they can bear the time required for opening the database on their devices (this can vary for PCs and mobile devices).
Second: users must use strong passwords to make the brute-force attack harder (possibly to the point of infeasibility).
Two-Factor Authentication in LastPass does not protect the password database, but the access to the online service which provides encrypted user's password database.
Once the database is downloaded it is a static encrypted file and 2nd factor authentication is not necessary to decrypt it.