Except that the seed for the TOTP is unique to each website, because the website generates it, as opposed to an user-supplied password that might get reused acr

Except that the seed for the TOTP is unique to each website, because the website generates it, as opposed to an user-supplied password that might get reused across website. The impact is limited to the already compromised website, which is pretty darn good.