Definitely a "Not necessarily." If the passwords were stored on the service's servers in an un-encrypted manner, yeah. But in the case of LastPass, everything's encrypted -- Even moreso if you use one of their methods of two-factor identification. Even if they got your master password, they'd also need the second factor for that to even be useful!