TOTP/HOTP can still be sort of trivially MITM'd - a phishing form could ask for your auth code and then turn around and supply it to the site in question. U2F

TOTP/HOTP can still be sort of trivially MITM'd - a phishing form could ask for your auth code and then turn around and supply it to the site in question. U2F uses a challenge-response protocol that should (in theory) make it impossible to MITM. Google has said that they have had zero successful phishing attacks since they switched to using U2F devices (I think Yubikeys) for all employees.