Can we not just make a password prompt which is two 8 digit TOTP codes concatenated together (each having different shared secrets)? Why must we use biometrics

Can we not just make a password prompt which is two 8 digit TOTP codes concatenated together (each having different shared secrets)? Why must we use biometrics, SMS, and proprietary lock-in solutions? Also, the recent Salt Typhoon revelations need to be screaming at you: Chinese intel (and probably others) can likely access SMS codes without hijacking the number, and that it's probably not far out of reach from criminal gangs considering foreign policy jockeying lately. Phone verification is dead. Also, everyone should be adopting something like SimpleX (plus Orbot/Tor) and get away from unencrypted normie networks. If before it was just to reduce metadata footprint because data sells, now it's because you could be vulnerable to international criminal organizations which have access just as intimate as Salt Typhoon to US public comms infrastructure. F***! Odds CISA gets funding cut under new admin? I could use a new job...