Non--browser-integrated password managers with 2-factor authentication are one of the best security solutions around right now. Every step away from that costs you security, but probably is still a good ways better than using passwords alone purely from memory.
I am curious, is there a way to do OTPs with offline databases?
I tried poking around with the add-in, but couldn't quite determine whether the implementation could properly protect from replay attacks, most notably whether a copy of the xml file used and the matching old OTP would be enough to unlock a newer database file.
Read the article - each attack it mentions only applies to browser-integrated ones.
If instead you mean "browser-integrated" as in the default "remember my password", well, those are not what this paper discusses and are generally better, though they are still not as desirable as a standalone less-privileged manager.
The idea that the password manager should be separate is practically common sense. Browsers provide more surface are for attack. Browsers are made to share content and work with network data. Ideally, your password manager should never touch the network ever. It has no need to.
