My employer's login flow asks for a username, then a 2fa, then a password. They do it this way because they fear someone could try to brute force passwords and create a denial of service attack by locking out all our accounts. This flow breaks my password manager and because I've not seen a similar flow elsewhere I'm betting there are compelling reasons not to do things that way.
What are compelling arguments for the traditional flow of
username -> password -> 2fa?