That's the same fear some people have about password managers...
IMO, the answer is simple: I would rather security be done by a company where security is THE feature. In other words, I trust 1Password's security team over, say, Hulu's or something.
Sure, but it's not a 1-1 comparison. If Hulu gets compromised you only lose your (hopefully unique) Hulu credentials. If your password manager gets compromised a single attacker gets access to _all_ of your accounts. The security standard for a password manager is much, much higher than pretty much any other service.
Password managers are still the best option for most cases, but having to put such an incredible amount of trust in a single company certainly makes me nervous.
The problem is a password manager becomes such a valuable target. Sure, they have more security resources given the nature of their business, but it's that password management company's security staff versus a world's-sized quantity of potential bad actors, and one of those two groups has more resources than the other.
I felt a lot safer using something like KeePass, and synchronizing the encrypted database using something like Dropbox.
There's not a central target that would get caught up in large scale attacks aside from Dropbox itself - and even if they get access to that somehow, they'd then have to care about me specifically enough to run expensive offline attacks on the encrypted database. Anyone targeting me directly with those kinds of resources already has better avenues of attack.
Not only password managers, popular OS as well. We may extend it to hardware as well but that's even harder to tell.
I don't trust password managers for sensitive data but they're fine for most web account with limited capabilities.
I made my own secret manager based on gpg/age (literally a 5 lines bash script) and I don't run it from any proprietary OS, like Mac OS X or Android. I trust my Arch Linux installation a bit more as I know which packages are installed or updated and I know what's running on it. Also I think an attack is less likely.
I also have a separate system to share secrets across devices which allow me to setup a public/private keypair (+password) on every device and then share links on unsafe channels (like consumer chat applications or email).
IMO, the answer is simple: I would rather security be done by a company where security is THE feature. In other words, I trust 1Password's security team over, say, Hulu's or something.