They have some serious security going on. For example you don’t just log in with a password, they also issue you a long key which is needed in conjunction with the password in order to access your passwords. So it’s not enough for a hacker to know your password, they also need the decryption key, which only you have.

And they have other measures on their servers as well. This is no fly by night operation.