Sounds like the bigger issue in this case is that it’s not clear to developers in which cases they can rely on DPAPI to be entirely local, which I assume is what’s needed for password manager style applications.