I disagree that storing these separately is “the whole point of MFA”. Passwords can be hacked in a number of places, not just client side or in the password man

I disagree that storing these separately is “the whole point of MFA”. Passwords can be hacked in a number of places, not just client side or in the password manager, so TOTP mitigates MITM style attacks where the password is known by an attacker but it was not gained from the password manager or the site. I certainly get that separating them would be theoretically better, but with TOTP in my password manager I end up using TOTP everywhere.