For the 99% user, they're a huge step up in security. The password many will use for every site is itself a single point of failure on top of often being an inc

For the 99% user, they're a huge step up in security. The password many will use for every site is itself a single point of failure on top of often being an incredibly guessable thing like "password" or "abc123". It being the same password for everything poses the security risk that a compromise of one company's data exposes your password for another company. Now they can be told they only have to remember a single password and that makes a difference, though it does need to be stressed that this particular password should be more secure than "password". They remember a single password -- which is ideally hard to guess -- then copy the randomly generated password for whatever account and paste it in the login form. A real worry is the possibility of a password manager service being compromised. However, these companies hire security experts and do regular audits of their systems and practices, which, when compared to the opsec of those who choose "password" for their password, is obviously beneficial. So of course we collectively decided that single points of failure are "good"; they are far better than what we had before. (Admittedly, perhaps one attack that's enabled is to discover services that are used by an individual via compromised data from the password manager service. I still get the feeling that such a compromise, even on a wide scale, is more easily done elsewhere.)