SafetyNet is also an issue on Android as soon as you modify anything or install a custom ROM :/

But even with an immutable distro you don’t have to reboot. The updated image just gets downloaded in the background and booted into when you restart. There is no harm in still being booted from the old image id you don’t specifically need anything only included in the new one. Nothing forces you to reboot.

That is true. But that’d be the case for any online/cloud 2FA service. So you could either have a local 2FA app just for Bitwarden or set up less secure but more convenient email 2FA.

I’d argue it’s implied that you mean the coming February if no year is specified.

I personally use Bitwarden for my 2FA needs. As others mentioned you can self host the server but personally I have no reason not to trust their SaaS solution, especially now that they offer EU hosted servers. If all you want is a basic authenticator app that does only one thing give FreeOTP a try, it’s made my RedHat. You can then sync the applications state.

Firefox Relay is the best platform agnostic option in my opinion. It’s free to use for the basic variant and with Relay Premium you support Mozilla and can use custom domains as well.