>I mean, if the attacker has writable access to your vault, he likely can observe you handling the unencrypted password or steal all your gpg key material after you unlocked it.

To be clear here, only if that implies access to the memory you control, otherwise, no. GPG is pretty good about local file access by an attacker and pass maintains that on platforms where that is possible.

I would not assume the memory separation on x86 to be reliable.

Access to the vault ≠ access to unlocked vault. This is the whole point of storing anything encrypted on your disk.

The password managers don't protect against a malware running on your laptop with root privileges and attaching to your processes. They protect against someone taking the disk out of your computer and trying to extract the passwords.

But if they have the disk and modify is, its still them who have the disk. So the "No binding between keys/values" and "No authentication of values" still dont work out, either. And they are able to modify the contents on my disk, they'd be easier off installing a rootkit, pass cant protect against that.