Why couldn't we combine the two? Make TOTP based on a higher-entropy secret with longer generated codes the only factor. This would prevent replay attacks of entered passwords, thus protecting against phishing, and ensure users have safe secrets (since the site generates the secret).