You don't actually need MFA. This whole thing came about because people reuse passwords between websites and websites have their databases hacked all the time so the same password can be used to log in on other sites.
2FA codes solve that because you can't reuse them between websites so one website getting hacked doesn't expose all of them.
You can easily reuse TOTP between websites, but not many websites let you set your own TOTP secret. They could easily do the same for passwords, but none do.
SMS 2fac isn't any better in this regard, since you typically receive the SMS on the same device that stores your passwords.