But as soon as browsers stop autocompleting fields marked with autocomplete="one-time-code", won't website developers start marking _all_ input fields with this tag? After all, why do people put autocomplete="off" on input fields anyway?
autocomplete="one-time-code" causes a different type of autocomplete behaviour, it doesn't disable it. Specifically for example it will suggest a one time code you received by sms if one was recently sent (on mobile at least).
Search fields. I don't want it filling in the users address or email address when they're searching for a customer.
We have customer service representatives that accept orders over the phone, including credit card numbers. These should not get stored by the browser as autocomplete data.