The most secure practice for any high-value accounts (email etc) is to use WebAuthn with a hardware key like a Yubikey.

TOTP is still vulnerable to phishing (a fake login page can ask for both a password and a TOTP code) so business/corporate environments are moving away from them.