TOTP is trivially phishable.

Code security is orthogonal to end-user authentication methods.

So, wrong on every count.