If you have that seed phrase, & any device with correct time can calculate the TOTP code, even a simple local javascript app.

Obviously that phrase leaked would mean hacker can also generate codes. So that's why those phrases should be kept extra safe, away from normal passwords.