I think password managers could be easier to use, but that the fundamental problem here is, well, fundamental. The major security win of a password manager is that you end up randomizing your passwords across all your accounts; it does no good to "manage" a series of related passwords that will get credential-stuffed as soon as one of your providers has a breach. To get specialized passwords for all your accounts, you have to be able to reliably use the password manager on all your devices, which means not only configuring it and regenerating passwords the first time, but getting it to work again and synchronize it on every new device you use.

If you're motivated, you can get this to work. But people are not generally motivated.

Password managers are a thing I could confidently roll out as a security officer for a startup, where people are in effect being paid to take what I tell them about opsec seriously. They're not something I could confidently roll out in a campaign.

If you're going to get a campaign to do 2, maybe 3 things, you're going to tackle 2FA, phishing (security keys) and attachments (Chromebooks, iPads, and GDrive viewers). If you could do a 4th thing, I don't know that password managers would make that list.

(For the record, I did one training with Maciej, at an NGO, not a campaign, with rooms full of people who were, if not well-motivated, at least super respectful of our time and who had at least the appearance of being attentive to what we were telling them. And getting 1Password working for any of them proved hopeless. I think even I stopped being able to make 1Password work for a couple days after trying it with them. Unlike me, Maciej has a gift for talking to people about this stuff, and also unlike me, he did these trainings dozens of times. If the best password manager he could roll out was Notes.app, people who make password managers might want to figure out why that is.)