I believe they are replying to the article you posted in regards to the download from legit sites comment, not the fact that the sites have shit web practices (which while correct is a different thing).

Basically the modified software was a trojan keylogger combo that was forwarding passwords created and used to a home server.

That’s not something that the sites are going wrong, nor is it the password managers fault. That’s fully the users fault for downloading a trojan.