Audits are - by necessity(1) - value judgements (otherwise we'd call them "proofs"). This audit concerned the source code.
I very much want a source code audit to make value judgements about the audited source code. That is its entire reason for existing, after all.
(1) audits involve examination and possibly testing. Neither of these can offer guarantees beyond "what we observed, is there / happened."
My big problem with KeepassXC is that the threat model is not well documented. It does a lot of fuzz around memory randomisation but it might be much easier to extract the secret key of the browser extension when unlocked. So I guess it mostly provides security for data at rest, but afaik this is not documented. A general security audit is IMHO difficult if nobody states any guarantees.
From each other, WebExtensions are sandboxed pretty well as far as I know.
I guess you're safe if you stick to always manually allow the password request and of course, practise the same amount of scrutiny regarding phishing as when entering passwords manually.
Or are you talking about the IPC between the browser and the KPXC app?
They’re closer to a procedural or logistical requirement, similar to a cross-check on an airplane. The FAA doesn’t mandate cross-checks because they prove that an airplane won’t fall out of the sky; they mandate them because they empirically reduce (but do not prevent) incidents.
For proofs, we have formal methods (which an audit can employ!). For value judgements, we have consumer groups and word of mouth.