Using a security key as 2FA instead of TOTP would have prevented this attack, right?

If you maintain popular open source packages for the love of God get yourself a couple of security keys.