I agree that there are easier things to steal. However, that should not allow us to be lax with the security of the TOTP secret key. I think it still makes sens

I agree that there are easier things to steal. However, that should not allow us to be lax with the security of the TOTP secret key. I think it still makes sense to worry about the theft of the TOTP secret itself. It's just an additional thing to protect along with cookies, TOTP codes, website data, etc.