You are missing that the TOTP secret will only be presented once during setup. It is now a second factor because you need to prove possession of the secret by

You are missing that the TOTP secret will only be presented once during setup. It is now a second factor because you need to prove possession of the secret by entering the current TOTP code during login. It will not be presented again, so an attacker needs to have been able to intercept the initial secret exchange. (well or phish for it etc.) You are usually prompted to enter the code during setup to ensure the secret has actually been put into some authenticator and is not immediately going to be lost.