Of course, but that still requires the attacker to specifically target me. Attacking some random service I have an account with and getting everyone's account info isn't enough.

This isn't the case; look up "credential spraying".

Do you mean password spraying? Or credential stuffing? Or something different entirely?

There are various design decisions that password managers can do to reduce this risk.

However there is always risk, the question is - is it better than the alternative? For most reasonably designed password managers the answer is yes.

Heck for the average person, a sticky note on the monitor is probably better than the alternative.

Any computer can get infected with a password stealer. As long as the password manager isn't significantly increasing the risk, then there's no problem.

All my passwords are “password” and I just use 2 factor auth for security.

This is pretty risky given how lax sone places are with allowing customer service to be talked into removing 2fa.

I've seen platforms that don't rate limit 2fa guesses. A six digit OTP has only a million possible values. Guessing once per second it only takes a couple days to guess.

This is also why a platform should never confirm that a password is correct when 2FA is enabled, only confirm if both have been solved.

2FA is usually time limited? So this seems not to be an issue?

Think about a time-based one-time passcode (OTP). Every 30 seconds you get a fresh code and the attacker tries to guess that code. There's usually a validity window of one or more OTP, so the attacker needs to guess one of several possible currently valid OTP.

This is a popular trick in CTF exercises and it's pretty quick if you can make 1000 guesses per second. Takes a couple minutes until you're in.

Because of fun probability stuff. The fact what your guessing changes doesn’t matter. It’s still a day to get a correct guess.

https://pulsesecurity.co.nz/articles/totp-bruting