Comment by waterproof

The QR code that you use to transfer TOTP secrets to a new phone, is static. It never changes (unless you add a new service) and it requires no verification.

Do with that information what you will.