They mention self-hosted. Unless there's a long-game supply chain attack where they infiltrate the vendor and poison the updates and nobody notices until it's t

They mention self-hosted. Unless there's a long-game supply chain attack where they infiltrate the vendor and poison the updates and nobody notices until it's too late (that disaster scenario can always happen), at least not all your passwords are gone the minute the central server where everyone's data is stored gets compromised I don't have much experience with either product but based on what the person said, that seems the most plausible reason to me. If 1Password does something like encrypting it for every user individually and so the server can't read the stored data (like when it's decrypted in the browser with the user's password, then an attacker would again need to compromise the website, wait, and hope nobody notices until their target logs in), then I guess GP really needs to clarify what they meant