TOTP credentials are also based on a shared secret known to both the client and the server, creating multiple locations from which a secret can be stolen. An attacker with access to this shared secret could generate new, valid TOTP codes at will.

Then what's the point? Are they just hoping that the password (if the user uses a password manager) is stored in a different place than the 2FA secret and therefore both don't get stolen at once?