Cloud based or auto updating password managers have this risk. The org behind it could push a compromised update any time. Standalone password managers would ne

Cloud based or auto updating password managers have this risk. The org behind it could push a compromised update any time. Standalone password managers would need the local machine to be compromised, which means a targetted attack. Far harder. Not beyond NSA types, but beyond a malicious employee or MitM actor.