The problem is that if they're getting phished with TOTPs then they'll walk through a scammer over the phone to let them access their accounts other ways.

You can put all the security in place all you want but 99% of breaches aren't coming from red team actors "hacking" into a system. It's way easier (and even moreso now with LLMs able to do robo calls with human sounding voices) and get Brian from accounting to give up his shit...or even the CEO to give up his.

I've seen it all, they willfully will give over their access because they're dumb as fuck.