True if your password manager has a terrible security model, but not so if secured itself by multiple keys that never see exposure to the internet.