honestly it doesn't really matter if they have access to my phone, because my Aegis and Keepass are protected by passwords, and different ones at that. anyway, I took your first comment into consideration and created a Keepass vault just for TOTP, with a different password from my password vault, of course, so if they access one of my vaults they wouldn't have access to my passwords. I deleted my Aegis since I won't need it anymore, but I kept a backup saved just in case.