Device bound is to a specific piece of hardware (whether it supports reinstallation at some level is debatable but I wouldn't use the term for it; Signal is essentially single-concurrent-device-limited even though it has migration capability, but since it can be exported, it's not truly device bound. Apple, Google keychain lock-in is vendor or maybe account lock-in, not device lock-in. "Non-exportable" keys from a secure enclave make it device bound, although a sufficiently functional reprovisioning process might make that only a technical distinction.

Passwords are "legacy" security technology at this point (in the sense of being outdated and bordering on obsolete, and yet still needing to be supported) -- password managers are tools to manage that legacy technology.