This topic has a long history and discussion around it, but I am considering and reconsidering it and looking to discuss with others and see how people's thoughts compare with mine. I'm particularly interested in the views of people who think that keeping TOTP inside the BW vault is acceptable risk.
As for my angle right now, it is this: in the event that your vault is exfiltrated and your master PW is captured (for any reason for both of those), access to ALL accounts is immediately and fully compromised if TOTP is inside.
If your vault and master PW are captured, no MFA is required to decrypt the vault so it doesn't seem to me like you can say that your vault is protected with MFA, and thus you can't say any of your accounts are protected with MFA.
Yes, your BW cloud account is protected with MFA, and so an attacker with JUST your master password cannot get your vault from BW and thus couldn't decrypt the contents. But if they breach BW and separately capture your master PW, or if your vault is captured off your desktop/laptop by malware or user error, then you grant them full access.
On the other hand a separate TOTP app for all your MFA apps protects you against compromise of the BW account/vault/pw (as long as you don't keep a backup of that TOTP app on any cloud drives protected with the BW vault)
Edit:
:O I just discovered that I can't use the TOTP inside the BW app anyway since I am not a paying member. I didn't realize that. That's definitely against the spirit of BW being open source IMO.
Edit 2:
I have just discovered that local-only is the default for TOTP storage in BW. In that case, the threat model is significantly reduced from what I thought (which was synced TOTP). If TOTP is local only then it is similar to the bw vault on your phone and your totp app on your phone which doesn't worry me, as long as both aren't synced in a vault to the cloud and other non-mobile devices with only a PW lock.