FWIW, I agree with everything you've written. My point is that it's very clear to see that Tavis Ormandy understands at a very deep level the tradeoffs and threat vectors of browser-implemented password managers vs. password-manager plugins. You may not come to the same conclusion he does, but Ormandy's position is not due to a lack of understanding

That is in contrast with this blog post author who fundamentally doesn't understand what he's talking about.