Your exchange key, if you add one later, is encrypted with a key derived from this password. Nobody who steals the database can read it — and a forgotten password means re-entering the key, not recovering it.