[bsza]

Unless the page gives you a captcha before the TOTP, which it definitely should.

[gruez]

None of my bank accounts use a login captcha. Presumably they mitigate bruteforcing using lockouts or similar. Even if they use captchas, captcha solving services exist that solve for less than a cent per solve. It's not a huge barrier.

[dns_snek]

Modern captchas only deter humans, bots will pass right through.