It also thwarts phishing and MitM attacks (assuming the browser is not evil), which OTPs do not.