> A local vault is better than a cloud vault, but if that local vault software is written by a commercial company there's still that risk.

Depending on your device and platform there's still "that risk" even if its open source. If you're compromised, you're compromised.