The pitfall is when the TOTP app is on the same device as the browser you want to login with.

But that's a general problem. 2FA should really mean 2 separate devices.