TOTP is not phishing resistant, passkeys are. Also can screen grab TOTP.