And all vulnerable to attack from anyone on the internet.

Minimize the information you provide. Use bugmenot to log in places that demand an account but provide no value to having one.

It’s an impossible problem at the moment. If you’re diligent about not re-using credentials you have too many accounts to remember. If you use a password manager you’re vulnerable because you have to sync the password database across multiple devices.

Hardware tokens are great but not supported everywhere and only as secure as the reset process that usually will involve tricking a human. Still worth having them. Yubikey https://www.yubico.com/ and Onlykey https://onlykey.io/ are good options. Search for hardware token, lots of choices.

PROBABLY not. Even if 1pass stores them in the cloud they should be storing hashes, not passwords.

But there are many ways to do it wrong. And new attacks happening as technology and methodology improves.