[tomasff]

Bitwarden Authenticator is a separate service. Even if you don't use bitwarden you can use this apparently

[wongarsu]

But if somebody compromised their internal infrastructure they could push out malicious updates to both the Authenticator and the clients of the password manager (most likely the browser extension), compromising both security factors at once