> a lot of phishing will come out of that to trick users to give away their master password

One thing you can do to mitigate is to set up WebAuthn 2FA for the password manager as well. If your master password somehow leaks (say, a keylogger), the attacker still cannot access the vault since they don't have access to your security key.