Not sure if this helps or hurts, but the places they're most likely to see a problem are in the clients and automatic browser plugin updates. An attacker doesn't even need to target a password manager directly; they can collect passwords pretty well with any compromised plugin, just not all of the passwords at once.