TOTP is unfamiliar or hard to use for most people, so they use SMS. Most sites don't support TOTP either. Even if you use TOTP, it's not designed to be shared,

TOTP is unfamiliar or hard to use for most people, so they use SMS. Most sites don't support TOTP either. Even if you use TOTP, it's not designed to be shared, for example look up what hoops you need to jump through to export a single TOTP code in Google Authenticator. And they used to not even have that option; they told you to set up multiple TOTP codes on each website instead. Even on 1password I had to look up a tutorial on how to import a TOTP code cause the menu is in a very non-obvious and deep spot.