But in cyber security based software woulden't you need constant updates against new exploits? In something like Fusion 360 or Matlab or office I agree, if you dont need new features you shoulden't pay for updates.
If password managers don't (or shouldn't) have an attack surface, what could (or should)?
I could also describe all the data that google stores as "just a password protected DB with a web GUI"