Considering I don't know my passwords, nor can I generate TOTP codes off the top of my head, both are "things I have" for me (a password manager + TOTP manager)

Considering I don't know my passwords, nor can I generate TOTP codes off the top of my head, both are "things I have" for me (a password manager + TOTP manager). And because of this, I prefer to keep the two things separate. That way you need to compromise two services rather than just one. Realistically though, once an attacker's gained access to your computer or phone, there's very little you can do to prevent them misusing that data. You can keep your TOTP on a second device encrypted with a Yubikey that you keep in a vault in Geneva, but it's not overly useful when an attacker can simply call your bank and read out the security reset SMS they sent you/him. I'm happy to hear from security power users if there's anything I'm missing.