Use an mfa app which supports import/export of backups. To name atleast one popular open source example: Aegis.

Do backups, than you can always fairly easy and fast restore your backup after loosing a device. Usually thats enough as in most (not business relevant use cases) you do not need mfa within minutes.

If you want to go one step further you can prepare an old phone with your mfa data and store it in anywhere in your flat/house and use it as drop in replacement after loosing your actual phone. Or you could setup your mfa app on a seperate phone of your mom/friends/son/daughter, if you dont have an old phone lying around.

Since mfa should actually not be on the same device or at least require different things (password and biometrics) I dont think using the totp of my vault is a great idea, right?

Totally agree with you. NEVER ever have your TOTP inside your password manager, most people overlook this small detail.

One thing you can do is export all your TOTP secretes / QR codes to some cold storage medium, like a flash drive, encrypted in some way and store that safely somewhere. To be fair, even if you don't encrypt that flash drive since it is offline you'll be safer.

The not ideal solution is storing the backup codes in our password vault.

If you want to have them separated from the passwords and login information I would create a second vault with a different password just for the codes and store them side by side.

I’m no expert but I think the best practice is generally to keep the backup codes in a non-electronic format in a secure location, such as on paper stored in a fireproof safe or a bank’s safe deposit box. You wouldn’t forget that location. It’s not a cheap solution, though, and a safe deposit box limits you to the bank’s operating hours only. Using your backup code is typically pretty rare, though.

I would not use the TOTP offered by your password vault, though, especially if the vault backs up to multiple devices or the cloud.

I use two separate KeePassXC databases. One for passwords and one for TOTP. They are being synced on my devices using Syncthing.

I use Proton Pass and Ente Authentication (2FA).

I can't access my Proton Mail without my 2FA, additionally I can't even access my 2FA without my email address (verification code is sent to my mail to unlock my 2FA codes + I need the master password). If i lose one of them I am screwed you would say, but it's not the case.

What I did is to write down my Proton Mail Password and its secret code for 2FA + My Ente Authentication credentials (mail + master password). This way I will always be able to access my Proton Mail, even if i lose access to my 2FA app.

This is the worst case scenario, i also have a second phone where i keep Proton Pass and 2FA logged in, so if I lose my main phone, I am not completely locked out.

Using the TOTP of the vault is fine for normal people. You're trying to protect against apps and sites leaking your password. TOTP in the vault does that. If they can access your vault then it's already game-over.

I mentioned this in a different post but I use both my password manager with totp as well as a YubiKey as authentication methods as I always have either my keys or my phone.

As for the recovery codes, SanDisk flash drives come with a password protected vault program that I put them in, then put that flash drive in my fire safe. Maybe not the most elegant solution, but it's worked for me so far.