This depends on your threat model. Imagine someone looking over your shoulder while you type in your password and TOTP token. Without TOTP, they would be able t

This depends on your threat model. Imagine someone looking over your shoulder while you type in your password and TOTP token. Without TOTP, they would be able to log into your account on a different device without having your current device. With TOTP, they would need some way to get the correct token when they login, which is much more difficult and more easily noticed by you.