I'm guessing nation-state because it seems they stole some source code/R&D. I'd guess China. That's their entire MO. Further the Chinese economy by any means necessary. Why waste years and millions on R&D when you can just steal it?
https://www.cbsnews.com/news/chinese-hackers-took-trillions-...
For something like a password manager using client side crypto, compromising the software supply chain of the client is an interesting proposition for an attacker.
https://www.france24.com/en/20110104-france-industrial-espio...
He said they put all their resources into industrial espionage and it’s pretty much their only focus.
The US does it also. Can't remember the exact number but contracts above 150 million can occasionally be "helped along" by national level assets.