Just as with normal server side TLS, the client doesn't send its private key (and it's not known to anyone but the client), so intercepting the certificate does

Just as with normal server side TLS, the client doesn't send its private key (and it's not known to anyone but the client), so intercepting the certificate doesn't do the attacker any good. But if communications intercept is possible, even with TOTP the attacker could intercept the TOTP token for that session and use it to log in himself.