I agree this isn’t the worst-case as you mentioned above. However, it is far from the best case scenario which is closer to “only fake testing vault data was exposed”.
The vault leak is acceptable in terms of Lastpass’s formal threat model but could still result in real user pain e.g. targeted spear phishing using plaintext fields like URLs, or compromise for users with weak passwords.
Personally, I say props for having the courage to do that. You would have saved my teammate’s finger back when we ran our first-generation robotics team. During competition he picked up our mini robot while it was running and his finger got caught in the gears. The situation went from all smiles to sheer horror in a split second.
We didn’t have any mentors with experience so we played fast and loose with most things, learning the hard way.
The vault leak is acceptable in terms of Lastpass’s formal threat model but could still result in real user pain e.g. targeted spear phishing using plaintext fields like URLs, or compromise for users with weak passwords.