In theory, the master password is never supposed to leave your device even with the cloud-based password managers. So, yes, you're trusting that their
clients do what they say they do, and I suppose an attacker could hijack the client and offload your password.
That said, the same risk applies to any client you use. Someone could have compromised the latest update of KeePassX as readily as they can compromise LastPass's client. If you don't have automatic updates then that's helpful, but I'm not sure it's producing enough security to be worth the extra hassle.
