Agreed. They live in BitWarden right next to the passwords. I lose some security, since compromising my password manager now also compromises my 2FA, but the password manager is itself behind 2FA, a Yubikey, and its backup codes are on paper in my safe.

Yubikeys can do TOTP. Why not just store the secrets on the key itself?

Laziness, old Yubikey hardware that doesn't do TOTP natively, logging in to websites on my phone. I probably should upgrade, it's just pretty far down my to-do list.

An attacker needs both the totp secret and the password, right?

(Just so I'm not misunderstanding something.)

Correct. So putting your TOTP codes in your password manager is no less safe than using the password manager in isolation, and likely substantially more safe, because it requires attackers to compromise your password manager in totality (which should be itself behind 2FA) rather than just phishing an individual password.

They sort of need remote code execution on my laptop, I'm thinking.

Qubes OS maybe a good idea here -- isolated VMs. (One VM for the pwd manager)

for extra precaution, you might want to store TOTP secrets in a password manager thats separate from the one used to store passwords.