I use Pass, and I’m tired of laughing at all these posts. Now I’m just ‘oh, again, what a surprise!’
My passwords are gpg-encrypted and stored in a git repository. The only improvement I can do is to migrate to my own server instead of GitLab (which I setup like a decade ago), but there’s some inertia as GitLab just works for now. And I see no real point of doing so.
The structure is open, but you can encrypt it with the external tools if needed. I have zero understanding of the attack vector when my password file name is Gmail or Proton or Server/1. Good luck doing something with it.