As a principle secure things should pay attention to details and follow best practice. For me,I'm more concerned about lack of kdf and rng. But it all depends

As a principle secure things should pay attention to details and follow best practice. For me,I'm more concerned about lack of kdf and rng. But it all depends on how the program treats the data after decryption and how your password db is stored and transported. You have to also keep in mind that users keep other secrets as well in a password manager,not just passwords. You're giving the public a secure secret storage mechanism,you should follow best practices because you don't know exactly what type of attackers your users face ,what type of specific data/creds they store in it or how they transport it.