You didn't address my primary point. Say we each have TOTP for say 20 accounts and our password managers on our phones with the credentials for them as well. W

You didn't address my primary point. Say we each have TOTP for say 20 accounts and our password managers on our phones with the credentials for them as well. We are system administrators with access to piles of PII. Account password resets require 2FA so email alone is not enough to spider to other accounts. Both our phones have been rooted and are accessible by a remote attacker because some "coworker" sent us a new beta app that was in fact malware. In both cases the attacker has all our passwords to all apps via our password managers. That is lost. We each are logged into 5 of these services and the attacker steals the cookies. Those are lost. Now what about the remaining 15 services we are not logged into? Things we don't log into super often but some of which ar quite important like AWS root credentials. In your case, the attacker goes and opens the Google Authenticator sqlite database and gets every TOTP secret you have in plain text. You just lost all 15 remaining accounts. In my case those secrets exist on a hardware token and can't be accessed at all. If I catch my intruder at this point I can be reasonably sure those remaining accounts were not impacted. Hopefully this clarifies the wider model I am working from.