Something to consider is a mis-alignment of incentives. When LastPass gets breached, they're not directly responsible for what an attacker does with the passwo

Something to consider is a mis-alignment of incentives. When LastPass gets breached, they're not directly responsible for what an attacker does with the passwords. When another site/service gets breached, they have to spend a lot of time making it right to the customer again (e.g. rolling back transactions, compensating for lost or stolen funds, etc.)