I think this really highlights the difficulty of squaring software with a lot of configuration options and one-package-per-program binary package management.

Sometimes a pretty good compromise is found, like with PHP, where there's a core package, and additional packages for a common subset of extensions.

Here, though, I both understand, and don't understand.

It's one thing to disable the favicon downloading, and Have I been PWNed integration. That's a fairly obvious case where the security is improved.

But browser integration, hardware key support, and TOTP integration are more nuanced cases. I know I would have a hard time using a password manager without browser integration...especially with increasing security friction adding up.

Security is very important. But security is not the end goal, the goal is to provide the best *practical* defense possible. Browser integration, TOTP integration, passkey support, and hardware key integration all can add enough convenience to actually improve security.