Well, I would say it depends.
The best case is probably the full theft on a serious online password organization. It is likely to be noticed and if the organization is serious it should warn its users as soon as possible.
Immediately below is the theft of your smartphone holding a local password database. You should notice it very soon (this could even be a better use case than previous one)
It is probably possible that an attacker manage to get the device containing the password database through a software attack. Simply the attack will have to be specifically targetted at the theft of your password vault. I have never heard of such attacks, maybe because they happened to be undetected, or were not massively spreaded. I admit that a massive attack is extensively analyzed and if it send password vaults it would be detected. My opinion is that the risk of encountering such an attack is quite low, but the possibility of detection would be very low too.
The possibility of a temporary physical theft of the device is slightly higher. The attacker has just to 1 take your phone, 2 extract the vault, 3 put it back in place. What has to be taken into account here is who could be interested in stealing your password vault, because this kind of attack has to be specifically targetted againt you. As far as I am concerned I would gladly accept it because I think the probability is close to 0, but it can be different if you are known to have access to highly sensitive data.
The last risk is that a member of the staff of the online password organization(including members of the staff of its datacenter) decides to take revenge on his boss because of any reason and steals some data including your own password database. As he can have legitimate access to the encrypted data the theft is likely to be undetected.
It is now up to you to decide what risks are acceptable and what are not. For my own use case, I have chosen a local vault, but it really depends on how you leverage the different risks.