This is misunderstanding the threat model. Assuming you're using a local password manager and not a 'hosted' one, the moment your system is compromised, you're

This is misunderstanding the threat model. Assuming you're using a local password manager and not a 'hosted' one, the moment your system is compromised, you're screwed anyway and so that single basket doesn't really matter anymore. If an attacker has sufficient access to read out passwords from RAM, it also has sufficient access to just keylog everything. To follow your analogy: if somebody physically breaks into your home and places a security camera pointed at your safe(s), it's not really going to matter for the average user whether all the safe combinations are on a single piece of paper. They're going to get them anyway, because they've compromised the environment and can just watch the footage.