I don't think the idea was suggesting that TOTP would be the _only_ method to get in. In fact the code just decides to accept or reject the incoming connection. The normal SSH auth flow would still need to be completed.

So you would need to brute force SSH (which is already decently hard) AND brute force the IP every 30 seconds.

This would stop the constant and relentless failed auth logs. (Yes there are other methods, but this one is novel and good as well)