>How am I to trust a password manager if something as obvious as this is allowed to be shipped to the end user?

You don't. Assume every online service you use subject to security holes. What defines a secure app from an unsecure one is revealed after a security incident. That's why I continue to use LastPass simply because they exemplified their security practices during their recent scare.