Last pass suggesting people change their passwords depends on if the vulnerability was discovered before it was disclosed and solved and if users have visited an infected site in case it was. It also depends on how the vulnerability was solved.
Tavis Ormandy is a very good researcher that has been poking at Last Pass for quite a while, and while it is possible for someone else to have discovered the vulnerability before him, I find this unlikely. However, if it was discovered it was probably not very widely used, since we haven't seen any leaks in the media so far and I don't think a breach of Last Pass would last very long without being discovered. In my opinion, it's not very likely users have been hit with this.
The exploit only allows access to Last Passe's RPCs without the extension, so an attacker wouldn't be able to gain access to your master password, but to the password of a site (or possibly a few sites) you've stored in Last Pass. So if you do feel like changing your password, change the passwords of the sites you access via Last Pass, not the master password.
Finally, if the vulnerability was resolved by removing the DNS entry and not by taking down the service, a MITM could potentially obtain your account details, but the likelihood of a targeted attack is pretty low unless an attacker can manipulate a web page they know you frequent and can also position themselves as a MITM.
All of this aims to a pretty low risk of Last Pass users having been burned, if they were it was likely a small number of users. I think the media circus that would follow Last Pass suggesting all users change their passwords would create more harm than good to the company as a whole, while only having a few users being affected isn't ideal, it's more manageable from a PR standpoint.