Is it not secure if we use weak passwords to protect exported PKCS #12 files with private keys? Consider a practical scenario as described in Microsoft's Expand Export a Certificate with the Private Key. We can see a certificate with private key can be exported as a PKCS #12 file, where the private key can be protected by a password (in Step 7). 

Questions:


If one day this PKCS #12 file is stolen by a hacker, then, can he perform an offline dictioary attack to this file?
Step 5 in that article reads:


  In the Certificate Export Wizard, click Yes, export the private key. (This option will appear only if the private key is marked as exportable and you have access to the private key.)


How does this mechanism works? Is the (un-)exportability guaranteed by a cryptography algorithm (so that no one can change the property), or only by a software method (so that hackers can change the property)?
If one day this PKCS #12 file is stolen by a hacker, then, can he perform an offline dictioary attack to this file?


Yes, that's possible. The password is simply used to directly derive a symmetric key, which is used in turn to encrypt the private key.


  Is the (un-)exportability guaranteed by a cryptography algorithm (so that no one can change the property), or only by a software method (so that hackers can change the property)?


Generally it is just a bit set to 0 or 1 somewhere. Where and how it is stored depends on the Cryptographic Service Provider (CSP) and the implementation of the key container that contains the private key. If it and the private key are stored in a HSM or Smart Card, it may be tricky to change it.