Wikipedia has a good overview of their (known) security lapses. Two server breaches, one known to have exfiltrated sensitive information. Several browser plugin vulnerabilities, one of which allowed arbitrary plaintext passwords to be stolen.
LastPass’s history is troubling but they’re also the biggest target out there. IMO, the entire space of “cloud” password managers is inherently untrustworthy.