Both are fine, take the easiest.

That’s what Arthur describes: you’re comparing from my point of view two non issues against each other.

If you don’t have the profile that either warrants:

• Google would risk business revenue by having to handle a mittm attack done by them or
• someone investing in an elaborate scheme to get a fingerprint copy

And that being worth it instead of just getting you personally is a very specific threat model where I lack the fantasy on what would warrant that.

Or to give the relevant xkcd:

https://xkcd.com/538/

And to answer your specific question: I personally went with keepass2android and have neither issues nor concerns so far.