* if password hashes from any site you use leak and they’re weak, you’re compromised everywhere

* if any site is or becomes malicious and its operators/hackers read your password, you’re compromised everywhere

This approach (maybe not implementation – its hashing is kind of weak) is fine if your master password is strong enough, which it should be.