My bank recently added the feature of removing SMS as an 2FA option - requiring TOTP. Now if they'd only add webauthn, but TOTP is pretty secure against phishing with a browser-integrated password manager (no autofill results in suspicion).
It's literally a worse version of regular TOTP. And they're in the minority even having 2FA!
You best audit the shit out of that code if you actually use it. Every. time. they. update.