Comment by Tainnor

That's not the only attack vector that is mitigated by TOTP. If a hacker is somehow able to intercept your password and your TOTP for a short period of time (e.g. because you're in an unsecured network at Starbucks or something), they can do exactly nothing with that knowledge afterwards. They won't be able to perform a replay attack, and they won't be able to guess your next TOTP, or any that comes after. The "only" thing they can do is attack you right at the moment where you're using the insecure network (e.g. with some sort of MITM attack).