For general purpose operating systems, you can PGP encrypt the secrets and pipe them to a TOTP cli program such as oathgen (I wrote oathgen as a PoC when I was evaluating 2fa options a few years ago). This way, you have confidence in how your secrets are stored and used.

    https://github.com/w8rbt/oathgen

I share your concerns about mobile apps and browser extensions that do TOTP. All the ones I've seen store the secrets in clear text.