I've also been hit by .* matching ... First of all, I find this really really jarring. It makes sense and doesn't at the same time. I also wonder how to properly only glob the hidden files but I'm too afraid to experiment.

Bitwarden has a really nice CLI that lets you backup your vault easily. I personally run bw export --format json --raw every few week so if for some reason I lose the "cloud" access, I can still migrate to self hosted or a different password manager. (Or you may choose to self-host to begin with)