Is it not secure if we use weak passwords to protect exported PKCS #12 files with private keys?
If one day this PKCS #12 file is stolen by a hacker, then, can he perform an offline dictioary attack to this file?


Yes, that's possible. The password is simply used to directly derive a symmetric key, which is used in turn to encrypt the private key.


  Is the (un-)exportability guaranteed by a cryptography algorithm (so that no one can change the property), or only by a software method (so that hackers can change the property)?


Generally it is just a bit set to 0 or 1 somewhere. Where and how it is stored depends on the Cryptographic Service Provider (CSP) and the implementation of the key container that contains the private key. If it and the private key are stored in a HSM or Smart Card, it may be tricky to change it.