lastpass has shitty security and they're constantly getting hacked.

It is encrypted, but LastPass allowed weak passwords until 2018, and also allowed low iterations on their vaults. On top of that, because the hackers have access to the entire vault, they can do local brute force attacks, bypassing any rate limiting LastPass had in place to prevent it. They're using massive mining rigs (or servers with a lot of GPU power) to run brute force attacks with thousands of guesses per second.