They are significantly more locked down and it's hardware more strictly controlled than most desktop OS's, so I would say that assumption is correct.

It is looking as though desktop OS's will catch up in this regard considering the progress that's being made with immutable root filesystems and sandboxing with permission sets for user facing programs.

Personally I feel it’s a bit weird when people keep their TOTP on the phone they use to access the service that requires the token. If the idea was to keep things seperate, then either your phone shouldn’t when the tokens, or it shouldn’t be used to access secure services.

Hardware token still feel like the safest option, but I also don’t what 8 different token generator in my pocket.

A hardware security key would allow you to have one thing in your pocket, used for many sites.

Depends on your phone. But it’s also WAY more likely that your phone gets stolen than your desktop does.