Except that TOTP codes are MitM phishable. U2F with its URL-checking (via browser cooperation) is needed.