Just realized my 2FA backup codes were sitting in my email drafts

Last month I was resetting my phone after it died on a job site near Austin, and I went to grab my backup codes for my email and bank accounts. Turns out I had typed them into a draft email back in March and never deleted it, thinking it was a safe spot. Anyone with my password could have just opened that draft and had everything they needed to drain my accounts. I spent a whole afternoon moving them into a password manager and deleting every trace from email. That draft sat there for 8 months, totally unprotected. The scary part is I do this for a living, I should know better. Do any of you use email drafts as a sneaky storage spot too, or am I the only one who does this? What's your backup code system that actually works?