That loophole is Google and probably cloudflare. Google has their own DNS service, a script tag on nearly every website, half the mobile phone market while being the default search engine on the other half, and provides email to the majority of people. Even if you try not to use their services, they still have an enormous amount of information about you.

Terrible security record?

Of the items listed in your link, only the second one seems problematic, in that I wish they had discovered the (non-password but still privacy related) issues first. Even that section acknowledges all of the issues are fixed. The only section that makes it sound like there is still a problem is the last one, which states that version X still contains the vulnerabilities, but in reality that’s just how versions work. Patching a vulnerability creates a new version.

Is there ANY record of passwords being leaked from 1password because of their own lack of security??

Almost by definition the stories in here should be pretty boring. Glad you had the awareness to keep yours boring.