If you use your phished credentials immediately (e.g. inline with it being phished), then it doesn't make a difference if they are using 2FA. You use the credentials they entered to login from a backend system automatically, and then if that ends up with a 2FA prompt, you show the victim the 2FA phishing page next, instead of redirecting them to the real app/whatever.
This obviously does have its own downsides (you have to maintain a login infrastructure, as well as your phishing infrastructure), but this was even seen before 2FA became common to detect if an incorrect password was entered into the phishing site.
It is definitely an improvement, but TOTP doesn't provide much protection from phishing, and as it becomes more popular more phishers will need to accomodate for them in their campaigns, further reducing their effectiveness here.
This obviously does have its own downsides (you have to maintain a login infrastructure, as well as your phishing infrastructure), but this was even seen before 2FA became common to detect if an incorrect password was entered into the phishing site.
It is definitely an improvement, but TOTP doesn't provide much protection from phishing, and as it becomes more popular more phishers will need to accomodate for them in their campaigns, further reducing their effectiveness here.