Sure... but "good investment" and "good VC investment" aren't exactly the same thing. 1Password isn't exactly small and it's not exactly poised to explode either.
I get that there's an untapped market of non-technical users, but I am rather skeptical that advertising alone will have much success in activating it -- they'd need some innovative approach that changes the way non-technicals approach password management.
The data that can be obtained on users by just knowing where they choose to create logins for is also worth immense amounts of money, without even talking about how often they login.
Correct, but also a warning sign. "Boring, hard and important" should rarely, if ever, be left to private companies as an isolated thing. They need to somehow be baked into the model of the other things that use it.
It's the same reason there should be no such thing as a "structural integrity" company separate from the building contractor.
Lot of money to make with those factors.