Password managers are the definition of "putting all your eggs in one basket". You need to compromise 1 (ONE) password to get access to EVERYTHING. They are a lot more convenient, but barely more secure than a plaintext notepad file. And some people actually storing bank accounts and credit cards info there. This is insane to me.
It is exponentially easier to practice good security hygiene for exactly one password than it is for the 200 or so passwords/sensitive numbers I keep track of in my password manager. Maybe you are extremely disciplined and can remember 200 unique passwords/passphrases each with 100+ bits of entropy and are (effectively) mutually independent, but alas I cannot, and neither can the billions of people who use the same 8 character password for every account. The best I can do is remember 1 high-entropy password that I change regularly, and have the password manager keep track of 200 other highly-entropic unique passwords.
My point is that having a single point of failure maybe theoretically isn't as good as having a bunch of passwords, but in practice nobody has the discipline to actually maintain good security hygiene, and thus it is practically more secure to use a password manager than it is to have a bunch of different passwords that are either the same or closely related.
The biggest problem, is that password managers give layman false sense of security and by doing so, they are putting him in much bigger risk than he was before. Most advertisements are basically implying "Use password manager and you don't have to worry about losing your accounts". This is wrong on so many levels.
People should be aware that password managers are just glorified notepad file with one password. And after attacker compromise password manager, he not only gets your passwords (lesser evil), he also gets all information about your accounts (huge problem). This is a pretty big deal. He doesn't need to search where you are registered, manager will tell him everything he wants to know. Possible damage is massive. Even if you reuse one weak password everywhere (worst case of password security), he doesn't get that amount of information after successful attack.
And I really doubt you actually need "200 unique passwords/passphrases each with 100+ bits of entropy".
Btw, do you know why password needs to have high entropy? It's not to stop attacker from brute-forcing login page (nobody is doing it in 2017), it's to make it harder to crack password hash, in case he gets it.
There is no point in using extremely strong unique passwords on accounts you don't care to lose. Even worse, by using 200 unique passwords with passmanager, in case attacker gets your one master password, manager will tell him about every single account you have. By storing a lot of info there, you are just increasing amount of damage you will receive after being compromised.
The whole system security is as strong as the weakest link in the system. It doesn't matter, if every single password is unique with 100000+bits of entropy. All it's around your one master password.
