One problem with that is if a person has a non-Apple product, Apple won't build the app cross-platform, so they are even further locked into Apple hardware then.
Might not affect that many people. But it would surely limit choice for those who don't even know about the lock-in later in their lives.
Any attempted lock-in is guaranteed to attract attention of EU regulators.
This is what Apple probably wants to avoid. They won't be allowed to play a "Safari" this time (i.e. all password managers are allowed, as long as they are a frontend to our own password manager).
Also, having the password manager as a separate app, it is likely they will be asked to provide a standalone password migration API for third party password managers. This would make switching to another ecosystem trivial for moms & pops, who currently need to deal with CSV import & export* if they want to move their passwords out of iCloud.
* Not sure what the situation is ATM, but a few years back exporting passwords from iCloud was not directly supported. I had to run a third-party AppleScript script to generate a CSV to import in another password manager.
Might not affect that many people. But it would surely limit choice for those who don't even know about the lock-in later in their lives.