Honestly even TOTP is negligent to support at this point.

TOTP is phishable, and the root secrets are stored in most TOTP apps (including Google Authenticator) in plan text, usually in SQLite, because almost no enclaves support the TOTP algorithm.

The only hardware devices that -do- support TOTP like Yubikeys or Nitrokeys also support WebAuthn in which case just use that.

A hard requirement of Virtual Passkeys and hardware WebAuthn devices should be a bare minimum for auth security in 2024.

Passwords and one time codes are phishable 90s solutions to the problem and it is nuts they still are so dominant.