1、Why not directly use the key derived based the wallet's passphrase?

Encrypting a master key which is then used to encrypt the actual keys is a fairly standard practice for encrypting data. Doing this allows the master key to remain the same so that changing the password does not result in having to decrypt and then re-encrypt all of the encrypted data. It only requires decrypting and re-encrypting the encryption key.

2、Why the unencrypted master key is stored in memory, why not private keys?

A wallet can contain thousands of keys (or tens of thousdands, or even hundreds of thousands). Keeping all of these keys in memory will use memory and possibly take up so much memory that the system is unable to keep running bitcoind. A master key is fixed size though, and fairly small, so keeping that in memory is not a burden.