I'm not aware of the acronyms, but I was responding to this:

"a code from your hardware token/authenticator app on your phone/SMS/etc is not phishable"

That certainly seems like it's wrong, and doesn't include an acronym other than SMS.

But apparently there's more depth to this space than I was aware of.

You misread that statement and the excerpt you copied completely changes its meaning if you remove the surrounding. Read it as:

"U2F/WebAuthn is secure because it does origin binding which is not phishable, unlike entering a TOTP or a code from your hardware token or authenticator app or SMS"

Putting the original parenthetical in between the start and end of the main clause definitely makes it easy to misread. I just moved the parenthetical to the end of the sentence.

I really wonder why typically the default policy is to convert a totp token to a longer lived token (keep browser authorized) defying the whole idea of totp. Used like this it seems like just two passwords or am I missing anything? Phishing seems really easy.