Vaults exist because running a farm by hand is expensive and fiddly. The contract claims rewards, sells them, rebalances and redeposits, socialising the gas across everyone and applying auto-compounding far more often than an individual would bother to.
In exchange you accept two things: a fee, typically a slice of performance plus a management charge, and the strategist's discretion. Many vaults can be upgraded or repointed by a multisig, so you are trusting a team's judgment and keys as well as their code. That is admin-key-risk by another name.
Vault share tokens are also a favourite target. Pricing a share against pool reserves has been exploited repeatedly, and a first depositor can sometimes manipulate the share ratio of a brand-new vault. Prefer vaults with a long live history, sizeable tvl, and audits covering the exact deployed version.
Related: auto-compounding, yield-farming, admin-key-risk, smart-contract-audit