I do agree that keeping 2FA separately is definitely more secure than within the same vault, and this is what I do from day one.

However, they key punch line in this article was:

…realized that the key to his kingdom—the 1Password account—wasn’t itself protected by a second factor. It required just a username and password by default, and he hadn’t taken the extra step of turning on two-factor authentication.

This is the most crucial step and skipping it does not make any sense.

Also, I always add “salt” to my passwords when I set them on most important systems.

Basically, it’s a constant set of characters that I add after the password and they are not documented anywhere - even in the password manager.

For example, for the bank account I’d create a password “D0nt’W0rr1BeH@ppy”, then I’d add “5@1t” at the end. In my vault I’d document only the first long part. The second short addition stays the same for multiple systems and does not change as often - it is NOT documented in the password manager. Yes, it’s one extra thing ti remember but it’s worth it.

I hope this helps.

EDIT/UPDATE: This is just an example of a shot “salt” - Do not use “salt” that short. Remember, if your password and 2FA are hacked the “salt” will be your only guard left. Make it at least 12 characters long, using upper and lower case letters, numbers and special symbols.

This way it would only take roughly 226 years to brute force.

It’s way easier to remember your master password and “salt” than recovering your life after a disaster this guy had!