Comment by self_awareness

TOTP are stored on the server without any salts. You get TOTP key, you can generate TOTP codes.

So TOTP only targets the situation that user account is compromised. It doesn't help you if the server gets compromised.