I wasn't specific about that. I should have said a full dump of their database.

Yes, if someone got into their supply chain, they could push a malicious update. That's also true of KeePass and every other password manager. There's no way to avoid that vector.