Sounds about correct, but this setup provides adequate protection against phishing and MITM attacks. The KeePass database itself can be hardened with a 2FA token.