>They get targeted the same and are not meaningfully different in their workings I disagree. The Attack surface of a browser is huge compared to a local applic

>They get targeted the same and are not meaningfully different in their workings I disagree. The Attack surface of a browser is huge compared to a local application. Browser password manager hacks only needs to exploit the browser itself (access password feature/addon) while the other needs to exploit the browser + OS +/ password manager (escape browser and access the application). Browser sandbox escapes have historically been a lot more difficulty, rare and expensive compared to in browser exploits. A local password manager is also not always unlocked and running unlike the browser one. Regardless, in the real world the most likely way to hack both is malware run on the device.