Most likely no. But some people refuse to use such passwords, even when using password managers. Also it was only a few years ago Sony was caught storing passwords in plaintext so… Unless you trust the service is hashing and salting your password, MFA can be a good idea.
> But if they can phish or otherwise capture my password, can't they just as easily phish or capture my one-time code?
The TOTP lasts ~30 seconds. So the attack needs to occur in real-time (opposed to a form that just captures information). Can this happen? Absolutely. But it still raises the bar for the attack.
But yeah I agree, forced 2FA is infuriating.
Though that site is likely also storing the TOTP shared secret in plaintext, beside the password, making it pretty much pointless. If the site itself is compromised, it's hard to come back from that.
Pretty much the best thing you can do is never re-use passwords across sites.
If I'm using a long random password generated by a password manager, are these attacks realistic?
> phishing / MITM attacks
But if they can phish or otherwise capture my password, can't they just as easily phish or capture my one-time code?
> (or I’m forced to use 2FA when I don’t want to)
IMO, this is the only actual use-case, and it sucks because it adds additional login friction for absolutely no reason. If you want to ensure I'm using a strong password, generate the password for me as a condition to disabling 2FA.