Never say never.

When somebody somehow gets access to your Keepass Database.

Kind oft defeats the purpose a bit having the second factor in the same place as the first. But I’m doing the same.

Source? Wouldn’t Apple use it own password manager?

Not as a secure one at least.

So you trust the KeePassXC developers. Im also using KeePassXC, but saying “trust no one” is BS. Except you audited the code yourself, which I doubt.