> even if they got your password, if they don't have access to your password manager they can't login.
Wouldn't the same argument go for a non-2fa password? What's the difference between a randomly generated 2fa secret and a randomly generated password here?