All webapps have that issue. Why I almost exclusively use FF/Chrome addon and android app.
The KDF Bitwarden uses is THE industry standard. It is not the best, but it is by no means “insecure”.
I’m not sure how backwards compatible BW is that you could actually use BW without auto-update. All updates are signed and should refuse to install by the OS/browser if not signed. The real question is how robust is the security around their signing system.