As others have alluded to, this is the "Login" keychain--a keychain of usernames and passwords that are unlocked upon a user's login. This is by design, not a security flaw.
When I tested, I saw banking creds in the ask list. If I want those creds from keychain I have to type my master password. But for some reason if I want all the passwords using this method I just have to click 'Always Allow'. Jacked up.