When exporting a vault backup as a ZIP (to include attachments), there’s no option to password-protect the archive. It would be useful to have an optional AES-256 encrypted ZIP export.
AES-256 encrypted ZIPs are supported by most major archiving tools across most platforms, so compatibility shouldn’t be an issue for most users.