Security Implications of Using TOTP in Place of Passwords?

Time-based one-time passcodes are typically used as a second factor in password-based authentication schemes. What would the security implications be of using *only* a TOTP code for logins? (e.g., an email + TOTP code to authenticate a user). Would this even be secure at all?

My intuition says this would be secure, as guessing a 6 or 8 digit code is 1 in 999 999 or 1 in 99 999 999, respectively, and these codes typically change very frequently. This …

cybersecurity passwords security totp