please for the love of fuck don’t have a parasocial relationship with a password manager, an encrypted mail provider, or any other security or privacy software vendor
you absolutely don’t need to defend the honor of a project you like. you especially don’t need to defend a project that’s provably doing something dangerous
when I call out keepassxc or proton or whatever in the strongest terms possible, I do it because it’s important. I do it to create awareness, not fear.