> Seems like the "Spectre secret" is a massive risk given that compromising it once without detection would compromise EVERY PASSSWORD THAT USER USES, even ones that didn't exist when the secret was stolen.

All password managers have a single point of failure: the master password. This is why 2FA is crucial. Spectre/Master Password doesn't have 2FA, but you can turn it on with all the accounts you have so there is at least that.