This was a supply chain attack, everything is vulnerable to this type of attack.

If I use the CLI through the bitwarden flatpak am I OK?

Been down this road, it doesnt exist, if you want actual privacy you gotta go full pirate, run a linux desktop with Kodi and the Jellyfin plugin, then run Smart Tube with waydroid. For hardware look for something with an N100 in it.

I use ntfy, they had some recent controversy over some AI commits, but, for me, if it works I’m fine with it. Havent noticed a difference. Mine is also not exposed to the outside world.