Potentially the server can request hardware/software attestation that would limit the choice of password safe to approved ones only. We don’t yet know how big/likely this could be, but in theory it’s possible.