You don't need a "TOTP device". It's software. You can easily write an authenticator for a smartphone, a pc, a digital dumb phone, or pretty much anything.
I think the real issue is that companies like SMS because of the tracking it enables. With a single number you get instant geographic + general socioeconomic data on user along a unique tracking ID. But the particularly nice thing about this ID, from a corporate perspective, is how blithe users are with it. People will happily "validate" away on numerous sites. Now, by "sharing select information with our trusted partners" (as seems to be the preferred T&C jargon) companies can create extensive profiles on their users well above and beyond their activities on any given site.
Obviously you get none of this with a TOTP. Instead you get better security, better portability, and less external dependencies. But no tracking. So SMS wins in the current state of the internet.
I think the real issue is that companies like SMS because of the tracking it enables. With a single number you get instant geographic + general socioeconomic data on user along a unique tracking ID. But the particularly nice thing about this ID, from a corporate perspective, is how blithe users are with it. People will happily "validate" away on numerous sites. Now, by "sharing select information with our trusted partners" (as seems to be the preferred T&C jargon) companies can create extensive profiles on their users well above and beyond their activities on any given site.
Obviously you get none of this with a TOTP. Instead you get better security, better portability, and less external dependencies. But no tracking. So SMS wins in the current state of the internet.