Should Custom post types and fields be in the theme files or in a custom plugin packed into the theme?

You will be rejected from the WordPress.org theme direcotry if you include these post types in the theme. The guidelines, which are available here, state:

Non-design related functionality is not allowed. (See: Plugin
territory examples
)

And one of the examples is:

Custom Post Types and Shortcodes

Regarding TGM, the guidelines have this to say:

  • Themes cannot include plugins
  • Themes cannot require plugins to work
  • Themes may recommend plugins from WordPress.org
  • Themes may only use TGM Plugin Activation or similar libraries to recommend and install plugins that are hosted on WordPress.org (by
    using 'required' => false for each plugin)

So you will not be rejected if you use TGM, as long as your plugin is recommended, and not required.

This is best practice regardless of the directory rules though. If post types are included in the theme, then if the user switches themes they will lose access to their content, because the post types are no longer registered. This should not happen from switching themes. The content may not display correctly in the new theme, but the user will at least still have access to it.