An app has a much larger attack surface (for instance from malware on the phone). TOTP has to use short easy to enter codes (six digit numbers), Titan is doing

An app has a much larger attack surface (for instance from malware on the phone). TOTP has to use short easy to enter codes (six digit numbers), Titan is doing a full handshake using modern cryptography with sensable key lengths. In many use cases pushing the button on the key is quicker/easier then using the app.