Unfortunately my iPad was recently stolen and I had LastPass installed on it. Both the iPad and the app are protected with TouchID and passcodes. However, LastPass keeps an encrypted offline cache of the passwords and other stuff including secure notes for bank accounts and cards, etc. I understand that it should be very unlikely for someone to get through TouchID and the master password for the app. Just in case, I can go ahead and change the password for all the critical websites, but I can't change anything about the bank accounts and other secure notes already in there. Should I be worried about someone getting the vault decrypted? I'm assuming the everyday petty thief wouldn't go through all that but some advice could still be helpful.
LastPass promises to that your password database can only be decrypted if the attacker knows your master password. So if you trust LastPass, you don't have anything to worry about.
However, given that LastPass is closed-source software, there is no way to actually verify this promise, and hence the security is based upon your trust in the company.
Still, given that you trusted the company enough to become a paying customer, there is no need to change any of your passwords. They simply cannot be uncovered without knowing the master password.