I'll start by saying that if your device is infected with malware and they can access memory as the root user of the system there's very little you can do. Also, I'm not a security professional by any means, nor am I a desktop application developer - I've mostly done stuff with web services/applications, but I'm going to go out on a limb and say that KeePassXC will be more secure.

When you login to the Vaultwarden web application it's going to exchange your passphrase for a private key. Ideally, this exchange is done over HTTPS with certificates you have trusted (not ignored), but it's still an exchange of your keys over the network. So, you must always be able to trust your network, even if using HTTPS, and be able to attest for yourself that neither your VPN nor your LAN have been tampered with in anyway that could allow for a man-in-the-middle attack. You also have to be able to trust your web browser, add-ons, and system, because your passwords (at some point) are going to be unencrypted JavaScript strings floating around in memory.

In comparison, a KeePass database is, in your case, only going to be transferred over the network via Syncthing, which you can now set a custom encryption passphrase for, while being a fully[1] encrypted file. The processing for KeePass will also be done on-device and can be sand-boxed using Snap/Flatpak or ran using FireJail and supposedly, as you mentioned, as good memory protection.

[1]: Some optional metadata, like a database display name and icon aren't encrypted.

Edit: I feel like I didn't answer the question enough, so feel free to ask any further questions, I'll try my best to answer.

Also, I don't think that 2FA is going to protect against malware that much. Hackers usually take advantage of how memory is allocated for an example, in 2019, Google estimated 90% of vulnerabilities in Android and ~70% of Microsoft security patches being related to memory safety.