I agree that "TOTP with user held keys offer relatively more control to the user than to the organization," but I would never call this "inherently less secure.

I agree that "TOTP with user held keys offer relatively more control to the user than to the organization," but I would never call this "inherently less secure." Just a different kind of insecure.