Bitwarden does come with an app for every major operating system. Or do you mean this authenticator app? It kind of goes against the idea to have this anywhere but your phone.
If you store your second factor on the same device where you login, there's really no need for an app (or a second factor for that matter), because if your device is compromised, you're screwed anyway. You might as well store a list of one time auth passwords on a piece of paper that you keep near your PC. In fact that way someone would have to compromise you physically and digitally, which may be more difficult. If you keep the paper on your person at all times, it will actually be pretty secure. If you use some encryption scheme for the text on top of that, you're already pretty much there. But that's complex, so people came up with hardware keys that you always keep on your person and that are not used for anything else. They are kind of the ultimate thing to deploy on scale, but still a lot of hassle for users. The next best thing is using an app on your phone. It's considerably more dangerous, but still much better than storing everything on your computer.
Phones tend to have much better security models than normal computers. So having both on a phone is much less of a risk than both on a computer. But if you're offering people to weaken their own security by increasing convenience, you're breaking your own security model anyways. You might as well let people opt out of MFA altogether, but fewer and fewer companies tend to do that. Not because technical edge cases might pop up, but because most people are lazy and that is dangerous.
Does it? I thought the whole point was to require something that's not stored right next to the password in the database, making it more resilient to leaks/hacks/incorrect hashing and salting, etc. I don't think there's a single site where I have the option to "remember this device" to avoid needing to put in a 2FA code on every login where I haven't enabled it on my personal devices, and on a lot of them, I'm not even sure the cookies have ever expired. This seems like a case of https://xkcd.com/1200/, although I'll throw in my favorite personal example because of how absurd I find it: on the Domino's pizza Android app, it allows me to open it after months without using it and order food charged to my credit card without needing to reenter my password, but if I want to save something new as my "Easy Order" to avoid having to manually put everything into the cart and then hit "checkout", I have to put my password in again for that!
I've been lazily (in the "lazy evaluation" sense, not the work ethic sense) moving my 2FA from a mobile app into Bitwarden precisely because it's way more annoying to have to take my phone out and manually enter a code from there v when logging into things (especially since lately I've noticed that I seem to get errors when the code still has a few seconds left in the UI as being valid after I've already gotten the response from the server not accepting it; I asumed that this might be due to some issue with my phone itself, but the fact that it still happens with the codes being stored in Bitwarden and visible on the same screen where I'm logging into makes me wonder if this is some new intentional thing sites are doing intentionally without regard to how weird an experience this will be for some people).
As other comments on this page have explained, Bitwarden already offers that as part of their paid features. In that case the authenticator functionality is embedded into the main Bitwarden app and not in a separate authenticator app.
The main app's integrated TOTP functionality is nice for low impact services (e.g. I don't give a damn if my third Nintendo account gets overtaken). But there are more critical stuff I want an actual separate system, and this authenticator app would allow that. In particular it's free so creating a separate account would be fine.
The common sense of TOTP = your phone is to me problematic, and I feel it led to the situation we're in with Apple and Google...I have 3 computers I can use at any time, and will yell at the clouds every time I have to get my phone for some random stuff that can only happen in a mobile app.
Same way people are vehemently raging against kids having smartphones and ask for more kids protection online, while most 2FA services will default to a phone auth (TOTP or SMS, or dedicated app). And more than anything, I wish people could lose/crush/obliviate phones with less impact on their life if they want to, it doesn't need to be the key to one's digital life.
