I agree it's not cryptographically bullet proof, but that didn't stop everyone from handing over their passwords to the private companies running password managers. Some people even hand over 2FA to them. Yet others have a file in their vault with their driver license or passport number.

One breach there and they have your bank accounts, utilities, and something approximating your identity.