The issue is that if someone gains access to your password manager then they have both your password and your totp secret. The whole point of MFA is that these should be different things.

I disagree that storing these separately is “the whole point of MFA”. Passwords can be hacked in a number of places, not just client side or in the password manager, so TOTP mitigates MITM style attacks where the password is known by an attacker but it was not gained from the password manager or the site. I certainly get that separating them would be theoretically better, but with TOTP in my password manager I end up using TOTP everywhere.

Good point. I'd agree that totp on phone > totp in pw manager > no totp, so using it in some capacity is definitely better than not using it at all.

If someone get access to my password manager, I’m screwed anyway. It contains far enough information to bypass any MFA of any service.

Well isn’t that a problem in itself then?

The way I understand it, the password database should only contain the passwords; then if someone got access to it (or your email app, same thing, as they would just do a password reset) 2FA would still protect you.

If someone gains access to your password manager, it is likely because you gave them access. If this was done under duress, there are bigger problems in the realm of physical security that are outside the scope of cybersecurity.

I think that’s true as long as you never upload it to cloud, but keep it either on one device only or manually sync across more devices.