As you can read on the keepassXC site, an audit checks only a limited snapshot of code. You can have flaws in the implementations on in plug-ins, for example in the http KeePass plugin (https://github.com/pfn/keepasshttp/issues/258).