Do I need to trust the vault manager?

No! Trusting the manager is not required - this is a core innovation of Valio. The proprietary CPIT security framework provides guardrails against managers interacting in a non-desired way with your capital. In summary, the CPIT (which stands for Cumulative Price Impact Tolerance) architecture is a framework that limits the price impact that managers can create with the capital that they manage. The CPIT framework is applied on a per-instrument basis (works differently for spot markets, lending markets and so on). CPIT is expressed as a % of the AUM for any given day. The CPIT value is established on vault creation, and can not be changed. For more details, check out the advanced user guide.
Example: if a manager has set CPIT to 5%, and they manage a 1m USDC portfolio, then on any given day they can create a total of 50k USDC price impact across all trades on that given day
Intuition: a malicious vault manager can reasonably steal the daily CPIT% that they have set for the vault. If you see that a manager is consistently having high price impact on the market and is losing money, you may want to withdraw your capital