If it is a mobile device the chances that a remote access trojan can access TOTP codes are low. iOS and Android have better security model compares to desktops.

If it is a mobile device the chances that a remote access trojan can access TOTP codes are low. iOS and Android have better security model compares to desktops. This includes device encryption, password or similar by default and sandboxing.