I fail to see why malware on a system would be able to steal passwords from the browser but not from a dedicated password manager.
Redline is simpler as it’s apparently accessing one sqlite database on the file system. Compromising a good password manager requires accessing its memory or recording the screen, and it can only obtain data while the manager is unlocked by the user, and even then only a minimal amount of data is made available or visible. In other words, the reason comes down to the cost and time to develop more complex malware, for a smaller number of targets.
password managers usually encrypt their backend DBs