Ultimately what this shows is that two factor authentication with either TOTP (aka Google Authenticator) or SMS is not ideal. It makes phishing harder for the attacker, but it does not prevent it.
Unfortunately he fails to mention that there is a way to do 2fa that does prevent phishing: Hardware tokens with the webauthn protocol.
Unfortunately he fails to mention that there is a way to do 2fa that does prevent phishing: Hardware tokens with the webauthn protocol.