If you're looking to compare a cloud service like LastPass to a local application such as KeePass, then yes, there is a security tradeoff.

With an application such as KeePass, where you have full control over the storage of your password database (presuming you're not putting it up on DropBox or something), the only attack surface you have to worry about is your own system and the devices on which your password database is stored.  Generally speaking, these are not likely to be subject to *targeted* attacks (or, as the media likes to call them, [APTs][1]).  As long as you follow regular security best practices on your system (apply software updates, use antivirus, keep a properly configured firewall and/or router between you and the Internet, etc.), your password database is probably safe from Internet-based threats.

Note that I am not comparing local threats (involving physical access) here, because this is something that affects both options pretty much equally - you must have a local copy of your password database somewhere in order to use it, so you will be equally vulnerable to physical threats regardless of whether you use a cloud-based or local-only solution.  That is not to say these systems are especially weak against local threats - protecting the database with a strong password and encryption algorithm largely mitigates this - but that one is not likely to be much better than the other in such scenarios.

In the case of LastPass and other cloud-based password managers, the attack surfaces and associated threats are much larger.  Their systems are always on, and are very high-profile and high-value targets.  If someone ever totally *pwns* LastPass, there's no telling what sort of systems they might find access to.  While I'm sure they take their site security very seriously, they are likely subject to just as many attacks as any of the other user-trusted services that have been hacked recently.  As the saying goes, it's not a question of *if* they will be hacked - just a matter of *when*.  On top of that, you *still* have to worry about the security of your own system(s) which synchronize with LastPass.

**Are LastPass or other clould-based solutions a tradeoff of security for usability, compared to locally-managed options such as KeePass?  Absolutely.  Is it worth it?  That's for you to decide.**

  [1]: https://en.wikipedia.org/wiki/Advanced_Persistent_Threat