Honestly a big debate, so it really depends on your threat model. Lots of people even keep their totp seeds within their password manager which basically defeats 2fa imo, but it’s highly convenient. Personally I keep my totp seeds seperated in a sandboxed user profile.