You're assuming a compromised password == compromised 1Password vault which is clearly not going to be the case most of the time