If you want paranoid level security, psono is probably worth a look.

I don't use browser extensions and I manually copy/paste my passwords to fill in entries.

On most systems copy pasting is heavily insecure since a lot of processes have access to the clipboard. autotype and thinga like browser extensions are considered more secure.

If there's malware on your system, when you can read it, the malware can read it.

You’re thinking about this wrong.

Instead of trying to pick the one that will handle a fail state best, you can more effectively assume a fail state and take steps to mitigate it. That is to say: implement key (in your case, password) rotation.

Just establish a trusted system, log in and change your passwords periodically.

You can even do rolling rotation where you only change a few each week.

If that doesn’t seem like the right choice to you, then consider this: you’re thinking about an unconfirmed or possibly even uninvestigated situation where your secrets have been compromised. The solution isn’t to find the secret handling software that deals with this situation in the best way possible, it’s to change secrets.

The way I see it, Password managers protect best against website password leaks.

By making it very easy to have different passwords for everything, one password leak won't compromise your entire online portfolio.

The self managed nature of keypass and vault warden makes them less susceptible to a major fup outside your control, i.e A business can't mismanage your passwords resulting in a major leak or deletion. For better or worse, you're in charge of your own database.

They won't protect you from various malware, except maybe a key logger that doesnt know how to copy the file? If someone actually wanted into your database without brute force, they could figure it out. If you find malware that's been on your system for a while (longer than you download something and AV stops it before running), change all your passwords. Luckily you'll have a handy list of everything.

Edit; another advantage is if they take over the computer/steal files there's not much they can do with an encrypted password file, its better than a txt doc with all your stuff.

I'll start by saying that if your device is infected with malware and they can access memory as the root user of the system there's very little you can do. Also, I'm not a security professional by any means, nor am I a desktop application developer - I've mostly done stuff with web services/applications, but I'm going to go out on a limb and say that KeePassXC will be more secure.

When you login to the Vaultwarden web application it's going to exchange your passphrase for a private key. Ideally, this exchange is done over HTTPS with certificates you have trusted (not ignored), but it's still an exchange of your keys over the network. So, you must always be able to trust your network, even if using HTTPS, and be able to attest for yourself that neither your VPN nor your LAN have been tampered with in anyway that could allow for a man-in-the-middle attack. You also have to be able to trust your web browser, add-ons, and system, because your passwords (at some point) are going to be unencrypted JavaScript strings floating around in memory.

In comparison, a KeePass database is, in your case, only going to be transferred over the network via Syncthing, which you can now set a custom encryption passphrase for, while being a fully[1] encrypted file. The processing for KeePass will also be done on-device and can be sand-boxed using Snap/Flatpak or ran using FireJail and supposedly, as you mentioned, as good memory protection.

[1]: Some optional metadata, like a database display name and icon aren't encrypted.

Edit: I feel like I didn't answer the question enough, so feel free to ask any further questions, I'll try my best to answer.

Also, I don't think that 2FA is going to protect against malware that much. Hackers usually take advantage of how memory is allocated for an example, in 2019, Google estimated 90% of vulnerabilities in Android and ~70% of Microsoft security patches being related to memory safety.

For the most part I think both systems are pretty even to protecting the passwords that are on your actual machine. One pro that I can think of for vaultwarden is its less likely that malware would be able to find it since it runs on the browser. One con of this is however you have an additional attack vector that is the server vaultwarden is running on. Should an attacker gain access to that server they could easily replace vaultwarden with a malicious version and grab your password that way.

the entire entire database is decrypted on unlock.

That would be the selling point for me to choose KeePassXC over Vaultwarden.

For high value accounts, use 2fa with hardware tokens if you can, and maybe use a dedicated computer (old laptop) with a bare bones software installation to minimize the likelihood of malware.