This argument is just degrees of risk. He's much safer using any password manager than not one at all.