Not sure why he trusts whitepapers over fully open source solutions. Perhaps if Bitwarden were more mature or Keepass more usable they would get more attention.
It doesn't generate as much marketing buzz on its own as a Lastpass or a 1Password does, but too many people have too much stake in their passwords for them to even consider a less secure solution solely based on marketing.
I'd prefer a CLI based password manager for it's flexibility.
My guess is that the lack of browser integration (with extensions) that helps people autofill on specific sites/domains is what keeps it from being recommended as much as LastPass or 1Password.
What it's still missing is the possibility to have (almost) concurrent edit on the database, if you sync that on the cloud. Talking about the KeepassXC browser, they are close to a release where multiple users will be able to edit the database without breaking everything.
And 1Password got plenty of attention and reviews, whereas Bitwarden did not.
Granted I’d prefer the open source solution when all other things are equal.
But I cannot trust Bitwarden with my data without hosting it myself and the current server implementation is expensive to host. Bitwarden copies LastPass as a model but I think that’s the wrong model to copy.
As you can read on the keepassXC site, an audit checks only a limited snapshot of code. You can have flaws in the implementations on in plug-ins, for example in the http KeePass plugin (https://github.com/pfn/keepasshttp/issues/258).