It is still optional most places.

Not for Chase, not for Schwab, not for my DOCSIS provider, not for my cellular provider, etc. They don't offer TOTP either, just SMS for 2FA.

It's going to require a law: if you require 2FA, then TOTP or HOTP must be offered as an option.