Is this a joke?

If password managers don't (or shouldn't) have an attack surface, what could (or should)?

I could also describe all the data that google stores as "just a password protected DB with a web GUI"