Comment by gregoryl

Only if the vault is cracked. If it's intercepted somehow, or pulled from a database dump, the 2FA token will still be secure.