I think the most useful threat model for 2FA is the case of a leaked password.

Malware on a trusted device or a local attacker are very hard to circumvent, though for that we have u2f which is reasonably safe against both.

I put 2FA in my password manager for that reason. If I have malware on my PC, I'm pwned, there are plenty of services without proper 2FA (looking at you paypal, amazon and my email provider) that I can consider myself pwned. However, preventing malware has become easier over this year alone, browsers do a lot and simple A/Vs like MS' built in one or ClamAV for linux can catch most of the dangerous ones.

So I'm not worried about malware.

I consider local attackers a more exotic attack vector and they are rare from my experience so I'm willing to take this risk in favor of making my life easier.