Of course the threat model is kinda skewed because this case is more applicable when one's reusing passwords or using weak passwords, which shouldn't be happening if you're using a password manager.
Maybe a more relevant threat is password gets compromised from a MITM attack, in which case they still don't have access to your TOTP
But as you say, since I'm using a password manager, this doesn't feel like a legitimate concern. If the application's database leaks, my password is still safe, because no one will crack a randomly generated 20+ character password.
> Maybe a more relevant threat is password gets compromised from a MITM attack, in which case they still don't have access to your TOTP
But they'll have the code, so as long as they use it right away, they can still get into my account and download my data / spam my contacts / whatever.
That's why you maintain the knowledge-possession separation at the access to your password manager (file) with a combination of a password and either a key file or hardware key.
If you store your secrets in encrypted files rather than specialized server solutions, it's also easier to separate and store them in different locations.
If you do not understand the purpose 2FA, there are plenty of online resources available.
As I explicitly wrote, you can store secrets in separate places, and if you don't, you still protect yourself against password recovery attacks or interception and add redundancy.