[a10c]

That extends to any and all applications. Nothing is stopping a local only Keepass installation from being exposed via a supply chain attack to start sending passwords to an attackers server. In fact, I trust 1Password's corporate infrastructure more than my own ability to lock down my personal devices.

[m1keil]

I don't disagree. Just pointing out that "zero knowledge" isn't the cure for every security issue.