Why would any "enterprise" customers trust closed sourced AND small-time password manager?
This morning my home doorbell didn't ring and a phone alarm didn't wake someone up. Two almost unrelated fails. As a result we missed an appointment which we fixed an hour or so later.
Right let's do the analysis: Doorbell is a Doorbird. I've got it running on a ethernet connection via PoE. All my home IT stuff is on UPS. I have a decent router that I know very well. I don't skimp on my home gear and I have a quite large VMware esxi which runs my home servers and stuff. I use Home Assistant which has a Doorbird integration and when you press my doorbell all my Sonos speakers say: "Ding dong, there is someone at the door".
I got it wrong: I thought that my HA box spoke directly to my Doorbird or vv. No it doesn't - it is all done via their API and that means internets.
Today I wired up a simple door chime to my Doorbird which will ring regardless of internets. The chime cost £10. The Doorbird has a chime output which isn't latching but good enough to make a chime ... chime.
So that's what I do at home.
Perhaps mindset related? Larger teams needed to meet enterprise needs? Or simply more focus on the sales machine to close complex enterprise deals, and less focus on securing the pipeline through which the product is made?
Solarwinds is a great example of this - "big enterprise software" used by big enterprises, and yet their whole build infrastructure was compromised as it ran with less security thinking than your average open source project (which at least discards build environments each run).
Or enterprise tools are a more attractive target for attacks. Due to that they should be better at this, so still shame on the slack ones.
As far as getting actual password data, yes, the attack surface is the clients, and as the most common client is presumably the browser plugin, it's probably the most likely to be attacked.