Is this a joke? If password managers don't (or shouldn't) have an attack surface, what could (or should)? I could also describe all the data that google store

Is this a joke? If password managers don't (or shouldn't) have an attack surface, what could (or should)? I could also describe all the data that google stores as "just a password protected DB with a web GUI"