You also need to have 2fa set up. And they don't have totp as an option unless you also set up either a security key or any number of options (sms, mobile push, others?) that involve getting entangled with google again.

Google really prefers you'd use sms 2fa over totp.