I really feel like both the author and the post on HN should specify that these vulnerabilities are specific to browser/online password managers.

Got very confused until reaching the end of the article where 'online' was mentioned specifically.