Evil.com phishes a user and asks for username and password for Good.com
Evil.com immediately relays those credentials to Good.com
Good.com asks Evil.com for TOTP
Evil.com asks victim for TOTP
Evil.com relays TOTP to Good.com and does a complete account takeover
The various physical dongles prevent this by using the asking domain as part of the hash. If you activated the dongle on Evil.com, it’ll do nothing on Good.com (except hopefully alerting the SOC at Good.com about a compromised username and password pair).