Is requiring the old master password to set a new one actually secure?

[grb]

There is a relevant feature request here:

Options to allow Passkeys to authorize actions and account/security changes protected by Master Password

Currently, the only way to recover a vault when a user has forgotten their password is if they have set someone as an emergency contact with full access, and that emergency contact is available to change the password. Or, if a device is already logged in and can be unlocked, the user has to manually save all items, contact support to delete the vault, and then manually add all the items into a new vault. There should be additional options for recovery. My first thought would be, since the PRF …