TOTP slows down brute-forcing a service through normal access patterns (eg login, password reset). By normal access, I mean as provided by the software/vendor. One would hope said service has rate limiting and other mitigations to prevent bad actors brute forcing this way, of course.

However it is a second defense enforced by process/code alone (which can be turned off if you have access to the source). It doesn't effect the way your password is stored on the server, in the event of a leak or hack TOTP provides no brute force benefit.