Another update. I asked Nir about what changed and got the reply:
"Instead of encrypting every password with DPAPI, they encrypt the passwords with AES-256, and the AES encryption key is encrypted with DPAPI and it's stored inside the 'Local State' file."
So AES-256 is really strong so that's good I guess.
What's slightly troubling is that Vivaldi keeps its "Local State" file outside the actual user profile.
For instance the file is in:
%localappdata%\Vivaldi\User Data
But the actual user profile is in:
%localappdata%\Vivaldi\User Data\Default
It's troubling because I've always thought that to backup you only needed the actual user profile folder (Default in this case), while the rest in User Data would be recreated on startup. Not a big deal but might cause some issues unless one's aware of it.