TOTP can also be safe against an impostor website if the TOTP implementation validates the domain name of the request before filling out the TOTP code. KeePassX

TOTP can also be safe against an impostor website if the TOTP implementation validates the domain name of the request before filling out the TOTP code. KeePassXC's browser extension does this, for example. Of course, if the impostor has hijacked the user's DNS request for the real website's domain name, and the impostor has presented a TLS cert for the real website issued by a CA the user trusts, then what I described will still leak the TOTP code. But in that situation WebAuthn would also be broken. The advantage WebAuthn has is that it's built into the browser, so the browser gets to enforce that the user isn't involved in ways that could weaken the security. With TOTP the browser has no way of knowing if it's a domain-name-checking implementation like KeePassXC or the user is copy-pasting codes from another program or another device without applying sufficient care.