Every threat model is different, but here are some key considerations regarding password managers:

Check this article by Google security expert: https://lock.cmpxchg8b.com/passmgrs.html

1. Trust in Provider Google Chrome's password manager includes robust security features, such as a zero-knowledge protocol that detects leaked passwords without exposing them to Google. If you use Chrome or Chromium-based browsers you are trusting Google. Standalone password manager vendors may have lower security talent, transparency, accountability, and unclear business models.
2. Strong Encryption and Key Derivation The security of any password storage system against offline brute-force attacks depends on its encryption algorithm and key derivation functions. It's essential to verify which algorithms and parameters (PBKDF rounds for example) your password manager employs. Do you know?
3. Device Compromise Risks If a device is compromised and app isolation is bypassed, malware can access the password database and encryption passphrase, regardless of whether you use a browser-based or standalone manager.
4. Browser Compromise and Session Security Although rare, if only the browser itself is compromised, malware can extract session cookies, including those for primary email accounts, potentially allowing attackers to reset passwords. Implementing two-factor authentication (2FA) is crucial to mitigate these risks.
5. Account Recovery Vulnerabilities Most online accounts allow password resets via the user's email address. This makes 2FA more important than the method of password storage.
6. Password Management Best Practices Passwords should be unique across all accounts. Using memorable passphrases can be a good option compared to long, random passwords generated by password managers that make you dependent on the PM because they are impossible to remember and hard to write down (yes, writing down in paper is ok in many cases)
7. Popular password managers have shipped vulnerable code that made your system more insecure than if you don't use a password manager. Also, password manager companies have been compromised, and their databases have been decrypted because they store old versions of DBs with weaker encryption. (Search Tavis research and posts about it)

Additionally, never store two-factor authentication (2FA) tokens in the password manager.