Safe is a relative term and not at all binary.
LastPass does exactly the thing I use it for, does it well, and does it mostly transparently. Allow me to easily use different passwords per site. While my LastPass might be hacked one day, if I reuse passwords, then my accounts will be hacked eventually. Not a question of if, but when.
Whenever news comes around that a particular site got hacked, I don't even pay attention. Who cares if one of my hundreds of passwords gets hacked?
LastPass is somewhat vulnerable, but the architecture of LastPass plus the professionalism of the team means that any threat will be seen coming by anyone paying attention, as reports of an exploit out in the wild. A few people will be caught flat-footed but not everyone.
When that happens, we can take steps to mitigate. If worse comes to worst, I can download a copy of the database, change the most important passwords so they're not in the online database, Gmail, banking and such, manage those manually, and hope my database doesn't get hacked.
If it looks like it's just getting worse and worse, I can spend an evening changing passwords and migrating to a self-hosted solution.
My data is safe in that an adversary would have to break through my personal defenses to get at it. They're not sitting in plaintext on some corporate server somewhere waiting to get hacked.