“Basically then it degrades to a very strong password that can’t easily be phished.”

I’m disagreeing with this, in that you are still (hopefully) using 2FA with your vault. Therefore whatever your accessing in that vault whether its a TOTP token or a password is still protected by MFA and not just a “very strong password”.

Putting a TOTP token inside a vault protected by a strong password and another form of authentication is no less secure then having it be separate from the vault.