> That's not to say it's useless, at the very least it's another layer that attackers have to figure out. But the true benefits of 2FA come from needing multiple devices to access accounts. If all of the factors are stored in one program on one device, then in the situation where that device/program is cracked, the attackers have everything.

I feel you're not portraying the trade-off accurately so I'll try to clarify.

It's not merely better because it's just "another layer to figure out". That's what you would get with 2 passwords. It's not what you get with 1 password + 1 OTP.

With OTP you're protected against your password being logged and used later on e.g. an untrusted or breached machine (say, at a library). I'd hazard to guess that dealing with a passive adversary who's time-separated from you is FAR more common/likely than having your actual password database stolen or cracked somehow. Meaning it's still quite a significant benefit to having OTP.