There should never be an expectation that your data is secure on Dropbox unless you use local encryption/decryption. Your data is sent to the dropbox server where it is encrypted by their server (according to their web site) and stored. They secure the data in transit, and then again for storage, but they have access to the keys.
There seems to be strong evidence that some checking is done before file transfer to see if the file you are syncing is already available somewhere on the server, and if so the file is not transferred, but does appear sync'd in your account. I noticed this personally when I placed the Access2007 Runtime installer into a folder and the 52MB file was nearly instantaneously flagged as synced.
Insecure authentication of an insecure system is not really a big deal. The lack of convenience for users if stronger authentication was used is probably a bigger concern.
If I have access to your local machine such that I can extract your local credential, I would easily copy all of the existing data from that machine, and could install a key logger to catch your password.