I agree for the most part but it doesn't entirely defeat the purpose. If someone got a hold of your password for a website it would still protect you. And let's be honest, that's the most likely scenario. But yes if someone got into your password manager then it's completely game over. A scenario where having a separate 2fa device would still protect you.
Since my "homelab" is just that, a homelab, I'm comfortable with using :latest-tag on all my containers and just running docker-compose pull and docker-compose up -d once per week.
Debian is great. It's basically Ubuntu (it also uses apt for example) but bit more traditional. In fact it's probably one of the most popular distros used in servers when you don't need the support that someone like Redhat can give you especially as a business. And if you can't live without "snaps" then you can install snapd on Debian.
I was distrohopping for like a year or two when I first got into Linux desktop. As soon as I installed Arch for the first time that stopped. Now the thought of a distro pre-installing packages gives me the heebie jeebies. You don't get to tell me how I sync with NTP servers!
I agree for the most part but it doesn't entirely defeat the purpose. If someone got a hold of your password for a website it would still protect you. And let's be honest, that's the most likely scenario. But yes if someone got into your password manager then it's completely game over. A scenario where having a separate 2fa device would still protect you.