If you like command line: TaskWarrior has due and recurring tasks and weighted priorities and more.
There are also some frontends under Tools, search for GUI, but to me they are more cumbersome than CLI. If you're into Vim then vit might come handy.
If you installed the original legit package it can't be updated with such fake one (without uninstalling and installing the bad one) as the signatures won't match. If you initially install the bad package then yes of course.
Hell no, having OTP in the browser kinda defeats all 2FA and makes it 1FA again.