how secure is the passwords app

No. Everything on your iPhone is end to end encrypted. Apple doesn't even have access to the passwords or data stored on your phone. Now, if you don't use a Passcode or have Find My enabled or use Two Factor Authentication, then sure your data is accessible to anyone who comes in possession of your iPhone. But if you use the security tools which you should be using, you don't have anything to be concerned about. It's extremely difficult to hack an iPhone. And to do so, would cost more money than bad actors could possibly have. Even the FBI couldn't hack into an iPhone and one would imagine they have significantly more resources than most on this planet.

No one could "hack" the Passwords app unless they were provided with your Passcode, Apple ID and Apple ID Password......or.....they were prepared to spend a million dollars or more to pay a company to try to hack your phone.

If you are a spy, a high ranking official of a government or a billionaire.....you might be a target.

iOS / iPadOS devices cannot be hacked or infected with Virus / Malware / Spyware *** unless you have intentionally downloaded spurious software or unauthorized apps directly from the internet and installed them on your device or/and have Jailbroken. 

It (Hacking) also depends on how careful you are in sharing sensitive and valuable information pertaining to your iPhone such as Passcode, Password, etc with your friends and family members.

Be judicious when sharing the device's sensitive and valuable information with friends and family members.

**The primary reason for this is Sandboxing. All third-party apps are “sandboxed”, so they are restricted from accessing files stored by other apps or from making changes to the device. Sandboxing is designed to prevent apps from gathering or modifying information stored by other apps.

Security of runtime process in iOS and iPadOS - Apple Support

The sandbox on an iPhone is a security feature that creates a restricted environment for each app to run in isolation from other apps and the operating system. It is a core component of iOS's security architecture and plays a crucial role in making iPhones more secure.

If you doubt the authenticity of the information provided earlier, you have two alternatives:

1. Report the hacking incident to local law enforcement authorities and actively pursue the case.
2. Accept the credibility of the information; it is impervious to hacking. Just as some individuals hold unconventional beliefs, such as a flat Earth or moon landing denial, one has the freedom to believe in anything. The choice ultimately rests with you in this open and free world.

Three major problems for a fully Apple user: No way to "generate a password" manually, no detailed controls over the characteristics of the passwords it creates, and no way to create passwords for systems that have more than 2 layers of domain names. These are simple parts of a basic password manager, one that Steve Jobs would not have let get missed on the first release of the app.

If I want to update an account that PasswApple doesn't automatically recognize, it does not have a mechanism to just create a password and manually save it.

Sometimes I need a 32 character password, but PasswApple won't do that.

system2.site.com and system3.site.com are separate systems in actuality, but the app won't recognize that.