If you generate random 16 character passwords and commit them to memory for every site (likely thousands you'll encounter over your lifetime), then fine, you don't need a password manager. For most other humans, it's a net win.
Having said that, passwords are a fundamentally flawed idea. Everyone should be using WebAuthn. Password managers turn "something you know" into "something you have". Webauthn skips the guessable backdoor and just goes right to "something you have". Much safer, and much easier to use!
If you use an offline password manager you don't need to use a browser extension. If your password manager requires a browser extension, it's increasing the risk profile.
Password managers are not a terrible idea. Certain implementations of password managers are a terrible idea.
Biometrics will take over, I definitely love FaceID on my iPhone. It just works and the fail rate is near zero on my 12 mini. FaceID that works similarly to Microsoft Authenticator for approvals should be all I need but we're not quite there yet. Effectively, given that I need FaceID to open MS Authenticator, we are already there.
How do we reliably be sure we are entering credentials in the right place?
I am thinking we need to look at a bunch of different factors, but what?
Lets take all of a user's credentials (mixing the critical and the trivial) and put them into a single database and then use Javascript-based browser extensions to control access to the DB. What could go wrong?
The LastPass communications brouhaha from last week was just a whiff of the total shit show we're going to see when the client code from one of these password managers is modified with trojan code and we realize that some group has been slurping up credentials by the billions over the course of a few months.
Seems like the charitable take is that password managers are maybe the best approach to a horrible idea, and the real solution is that we ought to be racing to abolish passwords altogether as soon as possible.