It doesn't have to be P2P, as long as the vault items are encrypted using device-specific secrets that are in a secure element (like iCloud Keychain). As long a

It doesn't have to be P2P, as long as the vault items are encrypted using device-specific secrets that are in a secure element (like iCloud Keychain). As long as there is no secure element in the loop, the security is limited. Secure elements can rate limit requests, require biometric authentication, etc. Without such limitations, you are only one upstream compromise away from exfiltrating all passwords.