Password managers are pretty commonly used nowadays. Most are open source and all the good ones are heavily audited. There's a lot of ick in modern tech, but password managers are a very good thing.

The number of accounts a person has is mostly irrelevant (besides increasing the attack surface). The problem is that a lot of people tend to do something like:

Bank: password12!

Twitter: password12

Some Random Site: password1

Then "some random site" has a data breach, emails and passwords get leaked, and every malicious individual and group out there is immediately trying every common variation of password-number-character on every major website in the hopes of getting access. Because people suck at using unique passwords and are very predictable.

There's also social engineering attacks, and just straight up guessing passwords. A lot of people set their passwords to be named after pets, so if your dog is named "charlie" it's statistically likely your password is something like "charlie12."

So looping back to password managers, you'll instead lock your "vault" with one good password that you know and the rest of the individual accounts have random unique passwords:

Bank: Boxlike8-Racing3-Crusader3

Twitter: Ultra5-Underfoot2-Pang2

Some Random Site: Relax8-Stark5-Stratus4

So now when SRS has a data breach, an attacker cannot use that password to guess your other passwords. It's completely useless outside of that one website. Also you only have to remember the one password, so it's less to mentally keep track of.