There is no sign that the attacker had a keylogger on the user's laptops, for extracting passwords. If they did, they wouldn't have needed to do account recovery on all these accounts. So the master password of a traditional password manager would not have been compromised.
Storing passwords in the same account creates a single point of failure. If I get into your Gmail account I have total control of everything.
Third party stores separate passwords from logins, including for the email account itself.
Now I cannot get complete control of all your accounts just via your gmail/logins account. At best I can control them for a short period of time. Which means I maybe get your Skype account for a day or so.
It's all about making it harder for an attacker to get something valuable. The harder you make it the less likely they are to succeed.
Because the login accounts and passwords are separated an attacker has to do more work basically.
Addendum: the single point of failure actually becomes the third party password store. Which is good in some respects and bad in others.
Addendum 2: also, iirc, Google stuff doesn't ask if you want to create a password for the account, only if you want to store it. Which encourages password reuse.
Password managers often have the ability to generate a random password up to the maximum allowed length, meaning no account passwords are ever the the same and are harder to crack.
Furthermore some of them can automatically update your passwords for you if they've become stale.
So all I have to do is remember (and regularly change) my one super strong pass phrase for the password manager.