I understand the purpose of password managers and the fact that there seem to be a trade-off to accept, but well, I find that trade-off to be unacceptable and I wonder if there's a way to avoid it. A password manager introduces a single point of failure, and that single point of failure is also pretty fragile: it's the user's machine. And we know that once the machine is compromised it can't be trusted anymore, and the damage can potentially affect all the data on that machine, so why should we accept to store all of our credentials on such a fragile single point of failure? I bet at the NSA they don't have password managers that allow access to thousands of passwords from one single computer, do they? There must be some alternative methods to manage passwords or to at least somehow mitigate the single point of failure they introduce.
Many people don't just need to store their own passwords, but also other people's passwords, like for example clients' passwords (for work), or some relatives' passwords (to provide support, etc). Some accounts are accessed daily, some only need to be accessed every once in a while, and there might be accounts in your password manager that you don't even remember having. So why should we accept to put all this at risk? It only takes one infection and hundreds of accounts could be compromised. Every account ever: not only your accounts, but other people's too. It's a recipe for a huge disaster.
You might think that once your machine is compromised you are screwed anyway, so avoiding the single point of failure isn't as important as it may seem, but think about it: for the sake of argument, let's consider the differences between storing all your passwords in a password manager on your computer and storing them on a piece of paper. Let's ignore the fact that the piece of paper introduces other threats, and just focus on the consequences if your computer gets infected. If your machine gets infected and you use a password manager that contains all your passwords, then the attacker can get all of them. But if your machine gets infected and you are just typing passwords from a piece of paper, what can the attacker steal? Only the passwords that you type between the time of the infection and the time you discover the infection. So only some of the passwords will likely be stolen, not all of them. Mitigating the problems related to this single point of failure therefore seems to be possible.
I tried to think of some solutions. I'm not sure if 2FA could really help in case the local machine is compromised, so I'm not sure if online password managers can help more than local ones in this respect. I'm afraid not. A possible solution could then be to use several databases in the password manager, with different passwords, so that even if one master password (and the corresponding database) is stolen, the passwords contained in the other databases will be safe. The different databases could group passwords based on frequency of use, or date of last use, or importance (PayPal account in a different database than StackExchange), or based on ownership (clients' accounts kept separate from mine). However it's not clear what the best way to group passwords is, and it soon gets pretty cumbersome, leading to several strong master passwords to be remembered. Another solution might involve some kind of obfuscation (custom made) added on top of the security by design already provided by the password manager, which I guess would work against most infections (non-targeted attacks). For example, combining obfuscation with multiple databases could be done by generating the password for each database with something like
master_password_for_DB = hash(DB_name + supermaster_password), so you wouldn't have to remember a lot of master passwords. Of course this only works because of obscurity, that is, if nobody other than me knows the method. Yet another solution might be to store everything on a separate device set up specifically for password management (like a phone with disabled connectivity), but that too is going to introduce some pretty big problems: typing a strong master password every time on the portable device is harder, and there's no way to copy-paste from it to the computer, so you will probably have to read it (a security weakness) and type it (a hassle).
I seriously don't think I have other ideas at this point.