The common objection to password managers is that they place everything in one container. That is accurate, and it still improves the overall position, because of which risks it removes.
Reuse is the dominant failure
Credentials stolen from one breached service are tested automatically against many others. Where a password is reused, the second account falls without any attack on that service at all.
People reuse passwords because remembering distinct ones is genuinely infeasible at the number of accounts now normal. The behaviour is a rational response to an impossible memory task.
A manager removes the constraint that created the behaviour. Unique credentials everywhere means a breach at one service compromises exactly one account.
Autofill blocks a category of phishing
Managers fill credentials only on the domain where they were saved. A convincing imitation site at a different address receives nothing, because the manager does not recognise it.
This inverts the usual defence, which depends on a person noticing a subtly wrong address under time pressure. The check becomes mechanical rather than perceptual.
It is also why refusing to fill should be treated as a warning rather than an inconvenience to be worked around by copying manually.
The vault is encrypted before it leaves the device
Well-designed managers derive an encryption key from the master password on the user's device and encrypt entries locally, so the provider stores material it cannot read.
A breach of the provider therefore yields encrypted vaults rather than passwords, and their resistance depends on how strong the master password is and how the key derivation was configured.
Weak master passwords remain the failure point, since an attacker holding an encrypted vault can attempt derivations offline without any rate limiting.
The risks that remain are different ones
A compromised device sees the vault while it is unlocked, so endpoint security matters more than it did when credentials lived only in memory.
Account recovery becomes critical, because a forgotten master password on a properly designed system genuinely cannot be recovered by the provider.
Passkeys extend the same logic
Credentials bound cryptographically to a site and stored on a device remove the shared secret entirely, so there is nothing to phish or to steal from the service.
Managers increasingly hold these alongside passwords, which keeps the synchronisation and recovery questions the same while removing the reusable secret.
The consistent theme is that consolidation is only dangerous when the container is weak, whereas dispersal guarantees reuse, and reuse is what attackers actually exploit.