Security risks of using Bitwarden as authenticator and password manager

Given the LastPass breach I think this topic has become very relevant. I see a lot of advice below stating that because Bitwarden is secured with multifactor authentication then it should be safe for you to store TOTP codes there AND use it as your password manager. The main takeaway from those points I think is that if your Bitwarden vault is compromised then it is game over anyway. However, security is generally a game of defense-in-depth and I do believe that separating the authenticator app from your password manager adds an additional layer of security. These are my reasons:

1.) I don’t think that you can count on your Bitwarden vaults to be protected by MFA. The LastPass breach highlighted that if someone hacks the password manager’s servers and steals the customer vaults then you are only protected by a single factor. The mitigating control in this case is the strength of the encryption and making sure that you are using a very strong master password and that the number of iterations in the derivation function is kept high and updated. Still, keep in mind that in this case your TOTP codes and Passwords are protected by a single (hopefully strong) factor.

2.) In the event your device is infected with malware no password manager can make guarantees about the security of the vaults. The reason for this is that the attacker can easily get your master password or just export the decrypted data on the client-side. However, if your TOTP codes are in Bitwarden the attacker has everything they need to access your most sensitive accounts. I would argue that makes it much LESS secure than even using text messages for MFA as then the attacker would need to perform a sim swapping, man-in-the-middle or social engineering attack to get the code. (Still stronger than e-mail though because an attacker who compromised your machine would almost definitely have access to your e-mail account via established sessions).

If you have a secondary authentication app that requires biometrics for access which is different than Bitwarden (and maybe even on a different device, for example an app on your phone rather than on your PC) you will have introduced yet another layer of security and difficulty for the attacker to access those particularly sensitive accounts. The main argument I would say in favor of storing TOTP code in Bitwarden is convenience. If you are less likely to use MFA due to the inconvenience of using authenticator apps and Bitwarden would make you use it more then you should probably use this feature (e.g. people with lower risk tolerance or family members with less technical proclivities). Otherwise, separating the authenticator app from the password manager would add an extra layer of security and it probably the right way to go.