It's not "unnecessarily" as it significantly increases security for most users by allowing them to use unique and strong passwords for every site and keeping passwords more secure on the hard drive as they are encrypted. It's far more likely that people who don't use password managers are either reusing passwords on more than one site, using weak passwords, keep them insecure on a notepad or email or forgetting/losing them sometime.  . All of which are more risky.  It's not "totally" blind trust.  Lastpass plugins are in javascript, so most of the source code can be easily checked. Encryption is done locally on the client machine. Plus it's a really company with physical address so they would be open to millions of dollars lawsuits if they were involved in any shenanigans.