Are you aware of Yubikeys?
AFAIK, 2fa is just another step before a server - executing code as it was intended - will return vault data to you. It doesn't protect against vault disclosure aka ransomware / data breach, similar to the Lastpass breach.
As for yubikey to authenticate into a vault, I'm not sure if it's something that actually strengthens the knowledge required to get into a vault (assuming you have the vault data yourself). Like, is it actually another secret required to decrypt the vault data? Or is it just another step the server verifies before it grants you access to download the vault data (and then decrypt client-side)?
> A PW manager relying on only a single password as the encryption key - and one that you type in frequently, mind you - has always been a little of a design issue to me.
Yes, I meant 2FA via FIDO2. It strengthens up the entrance to your vault. No key? No entry.