Sure, what does "the Secure Enclave or TPM could theoretically do this" do for me, if I've got a a trio of desktop PCs running macOS/Linux/Windows with no Touch ID between any of them and I want to keep my passwords synced and reasonably accessible?
Whenever you add a new secret, you have it encrypt a copy to ideally a smartcard on your keychain and as a hail mary to each of a quorum of of keys held by secure enclaves that run an open source remotely attestable VM using TDX or SEV-SNP for provably encrypted memory, proof it is not logging, etc. You can also shamir-split encrypt to m-of-n geodistributed key shares stored offline as a double hail mary. All of this would be automatic and transparent to the user.
When you add a new device you must approve from an existing device.
That cryptographic approval, ideally a passkey tap, can start a process to bulk decrypt passwords and re-encrypt them to the TPM key in the new device in a hosted remotely attestable secure enclave the device verifies. The user can be given a chance to cancel this transfer within a reasonable period of time like 48 hours. This extra time could be bypassed if a user has a second device attached to their account. A user could also release one credential at a time manually and explicitly on both devices following the usual rate limit rules etc, or bypass the limit if both devices can be directly connected, or use an offline recovery yubikey or last resort offline bootable recovery usb for expedited recovery as well, etc. Good to have multiple fallback recovery methods that tolerate at least one machine being compromised at all times.
This is just one example scheme. There are many many ways to solve this in a way users are protected without them having to learn to do anything more complicated than account recovery on any web service ever.
I really hope someone rips this off and runs with it. My team and I have open sourced everything required, as have many other teams.
Like if someone wants a password manager that either prompts them or requires a yubikey for every password, that's fine, but expecting everyone else to be on board with that isn't reasonable.
I'm not really willing to accept a level of convenience other than "unlocking my PC lets me autofill website auth without any additional steps", and I'm happy with the level of risk that exposes me to.
But sure, if the tiniest bit of effort is too much, there isn't really a good way to make passwords actually secure for you. Hopefully that doesn't have any totally unforeseeable consequences for you down the line.
If you cannot be bothered to touch a device when it blinks in exchange for having defense against phishing and malware, then I am going to assume you believe you are magically immune to phishing and malware.