But nothing theoretically stop them from getting your master password.

You have to put a lot of faith in them and the question why would you always remains.

Nothing stops anyone from getting your master password, including Google, Microsoft, Apple, Firefox etc..

The thing here is motive and incentive, LastPass has not motive or incentive to handle your passwords in an unencrypted form, it has no motive or incentive to want to know your master password ever since both of those things are just a huge liability for them.

Every password manager, every browser, every OS, every hardware can be backdoored and compromised by their maintainer/manufacturer in a way nearly impossible to detect even in some cases if the source code is fully or partially available, heck how many people ever verify that the package they just grabbed via the package manager was built using an unaltered version of the source code?

To function you need to have some level of trust, you can try to add additional security measures e.g. like not storing highly sensitive passwords in a password manager but even then really depending on how you maintain those passwords you are likely to increase your risk rather than reduce it.

Spot on. And it's certainly better than what chrome does, or at least used to do. Which is no encryption at all.

The only other option is to use something like this to-do it yourself.

github.com/ezWebDevTools/ezCryptoJS

To be fair, that's true for just about any password manager unless you audit the code and use reproducible builds. It just tends to be easier to place these kind of backdoors in web apps because the code is basically re-downloaded each time ... which is worrisome given their, uhm, antiquated app "architecture."

Native apps, on the other hand, tend to have signed updates and such. I'd pick a native password manager over a web-based one any day, but the theoretical risk is still there.