Followed the link and the read me is bit spare on details. For the less technical this still would require the phishee to manually enter credentials which then can be relayed to the attacker. Correct? The article mentions this happened while the author was asleep — any thoughts on how that would work?

One thing that can happen is you get enduring credentials from the OTP sign-in, and they last despite other credentials simultaneously existing elsewhere.

I only use Facebook trapped inside Facebook Container in one Firefox on one computer. But my understanding is that it's possible to sign in to Facebook from say a phone and a laptop at the same time, so the bad guys could get you to give them working credentials one day and persist those until you're asleep before using them. If you went to Facebook's security settings "Where you're logged in" and it lists two logins, one in "Paris" while you are in New York, you might realise there's a problem and force them out. But most people likely never look at that, why would they?

I might be tempted to enter the TOTP, but my browser is unlikely to enter the password, and I definitely won't.

I think the fact that password managers can spot incorrect urls better than users is useful. However I've become numbed to this warning flag by those services that seem to have endless different urls that are all legitimate. (Microsoft being a particular offender here).

I can imaging some variant of outlook.microsoft.developer.really.yes.com catching me unawares one day.

Microsoft does seem to know how to do this correctly when they have to, as they offer WebAuthn and there is deliberately no way to tell WebAuthn "I know this is outlook.com but I need live.com credentials". So they will bounce you through the right name to make it work. But you're correct that for phishing this habit of making up new DNS names is a problem, ie it convinces the lay person they have no idea and should just fill in their password wherever it's requested.