Nordpass lets you self-host your password database.

1Password stop doing that and makes you use only their own cloud infrastructure.

I trust 1P cloud storage more with their well thought out security concept than Dropbox or self-hosted nextcloud. The 1P security whitepaper goes into great detail why their cloud concept is not at all comparable to just hosting the vault on block storage.

There are companies who are pulling in the rein with regard to placement of sensitive data. That is, going cloud-less (or more accurately, privately-owned public cloud, and more often, private cloud)

SOC 2, HIPAA, and ISO 27001 and various military guidelines are a few reason why.

And yes, apps should also password-protect and event-log the URL configuration field separately from the password used in database(s) as well ... from any change, accidentally or maliciously.

That is following inline with still-so Common Criteria guideline.