I'm not sure which of these is more scariest. It also depends on the user, or their past choices. E.g. I reused passwords before I had a password manager else I couldn't remember all of them.

> the disadvantage of a TOTP app on your phone is that you type in the one-time code by hand

The main disadvantage is the cost of time.

Another disadvantage is that the code can be read by anyone around you. With something physical you got more control over where you keep it, though that also has its disadvantages.