If you wish to retain the "two factor" aspect, you can put your 2FA codes in a separate keepass database. You do lose the "two separate devices" bit of extra security (your threat is now keepass-aware malware or keyloggers with filesystem access), but if your one db is compromised the 2fa codes are not (and vice versa).

However, storing 2fa codes alongside your password is still more secure than not. If the service password is compromised without the 2fa seed (main threats: MITM, phishing), the one-time password prevents the account from being immediately compromised.

"One of these days" I'm going to get a safe and print them off and remove them digitally.