The file describing the requirements can be public. The requirements themselves are publicly stated.

I'm less concerned about attack surface and more concerned about just not having to deal with the logistics of safely storing and syncing something sensitive that I could also easily lose or not have with me on a mobile device or freshly formatted, self-owned device far away from home. I also don't want to have to trust someone else to store it in the cloud for me, especially if that someone else is handing me a closed-source app to do that.

In practice, bitwarden is a heck of a lot easier to get on a new device than a hash app(let) du jour + master password + execption list.