I actually agree with the KeePass devs. There are two levels of local compromise, root compromise, and user level compromise. Both are really bad for the user,

I actually agree with the KeePass devs. There are two levels of local compromise, root compromise, and user level compromise. Both are really bad for the user, but if the root access was cracked then we can assume there is a key-logger at the dev/tty level tracking all keystrokes. If it's the user-level then we can assume all home dir files are exploited. There are shades of grey here, because if the user runs a flatpak the app cannot be replaced so easy, but config files can be changed. I would imagine the database file could be setup to bundle the config file, or even take a hash of the config file to be kept encrypted. But still, it would not be too much of a stretch to presume any version of the program could be run under a debugger to capture input, regardless of config files.