Peoples credentials are increasingly captured by information stealer malware, including attacks on Keepass. It's not just services mishandling their data that people should consider as likely vectors.

I do agree about evaluation - it doesn't matter much with stuff like a forum account that has 2FA, but I certainly wouldn't put any of my banking or key account 2FA backup codes or credentials in a password manager or central account/password storage service. It weakens your protection if something does go wrong.