In that case a password manager that can be locked, or locks more frequently, then removes the decrypted data from memory, and requires the master password anew when unlocking the database may be a safer option. It's like encrypting a file and storing the password right next to it. If Lockwise doesn't require your password, neither does a benign or malicious program, especially if the credentials are cached on the file-level. Since your credentials are cached to prevent you from signing in every time you use Lockwise, Opera presumably was able to access your database using those cached credentials - as would be an attacker.

So the encryption key is derived from your Firefox username and password. PBKDF2 and HKDF with SHA-256 to create the encryption key from your Firefox accounts username and password. None of the approaches are inherently 'bad' though. In Lockwise, you can 'secure' the local storage a bit by setting a master password. Password management is always a tradeoff between convenience and security and at the end of the day using a reasonably secure password manager is much better than having a super-secure one and not using it. Third-party password managers will often take additional measures to protect the local data, at the cost of additional hassle for the end user. Presumably also with the idea that if you make password management easier, then more people will use it - and this will be a greater security benefit overall. Major browser vendors mostly go with the latter. Therefore it doesn't make sense to expend much effort against attacks by other programs running within your account.

The other is that there is no defense against an attacker who has access to your account anyway.

Thus data should be locally encrypted and locked down as much as it can.

One, often leveled by third parties, is that access should be as hard as possible.

The question of whether data should be protected against other programs is something that comes up in the media and online discussions quite frequently. Lockwise cloud storage appears to be secure. The term 'secure' depends on your analysis.

Firefox saved logins missing