One one hand, if I lose the database or manage to forget that password, I am fucked.
On the other hand, that's also the case with 2FA.

The latter has already happened to me, but I have since switched to different software that lets me properly manage backups rather than doing only cloud bullshit.
Cisco Duo. That piece of shit doesn't even do version control.
I just turned on an old phone, and there goes my backup, overwritten by old data.

No.

The password is actually physically written up on paper in a huge stack without reference or context in a "if something happens" folder for my wife.

I also manage my 2FA in that safe which counters the idea of the second factor as defined by the companies but my safe itself is a second factor.

Database loss is impossible for me because of a misconception in your description: basically by definition, backups can't be "overwritten" with old data . A backup is write-once. Everything else is just a sparkly copy.

I'm serious: change your backup strategy please! Incrementell backups don't use that mich more space and actually back up a status of what you had no matter what you do after or why your local data is broken.

"I overwrote my stuff" should never destroy a backup IMO.

I use keepass, but i have 4 back ups on different drives and 3 locations. I also have my main passphrases written down on a notebook that are also encoded with a Caesar cipher. Haven't lost data yet. If I forget my password or lose my book, I'm fucked, but that's security

I export my password vault every now and again, encrypted with my master password and stored on at least 3 seprate devices. (selfhosted Vaultwarden/Bitwarden)

Caesar cipher

And now everyone knows what to do.

You could do a sort of physical 2FA by requiring 2 pieces of paper from 2 different locations. Either a long password split into 2, which would allow partial weakening with either one, or random OTP and cipher text.

I have, mostly. The problem was I trusted the automated cloud backup, thinking Cisco knows what they're doing when designing their app.

Aegis is taken care of. It automatically creates one file for each update, and keeps them. That gets picked up by rsync.

KeePassXC unfortunately only keeps the last 1 version. Good enough if something screws up while saving, but otherwise kinda sucks.
Anyway, all syncs are manual, and only happen in one direction as I don't plan to generate passwords on my phone.
In case of corruption, KDBX doesn't unlock. Though I guess there could still be some silent screw-up during the saving process, so I might have to do version control anyway.
Currently the only place where all (major) past versions live is a CD, because that's a WORM medium. That one is also least convenient to use. Take a copy of the databases, generate PAR2 files with 500% redundancy and 512B block size (because they're tiny anyway), generate checksums, load disc, load old session, create dir with current date, put new files there, burn, verify.

I am not really sure how to handle it. Perhaps I should learn git.

Edit 1: Nevermind, I am idiot. The backup format also has a {TIME:<format>} option. I'll use that from now on. {DB_FILENAME}.old.kdbx is just the default.

Edit 6: Removed unnecessary text.

I have my self hosted vaultwarden's recovery key in my local keepass. Not sure why, just reflex i think

I have two, and remember the majority anyway. I have they key for one in the other.