In all fairness, I see OTP/2FAs as more of a solution to credential stuffing than anything else.
They only last for 30 seconds, requiring better infrastructure(automated logins) which also tremendously helps with detection.
The vast majority of phishing is just storing passwords for later attempts.
TOTP by design can be stronger than password. the seed can be pseudo-randomly generated therefore you cannot guess the code without it, even if you have previously generated codes.