I would consider a targeted attack to be less of a risk than a systemic attack on a password manager provider. Local invasive vs. remote non-invasive.