I'm not sure about the email thing, I've just never used TOTP by email. Anyway I don't see anything glaring. The TOTP code has enough entropy that it won't get

I'm not sure about the email thing, I've just never used TOTP by email. Anyway I don't see anything glaring. The TOTP code has enough entropy that it won't get cracked in any reasonable amount of time. If you rate-limit login attempts, that would be better, but either way I think it's infeasible to crack. And it's a lot better than letting users use short or common passwords that are on some list already!