But as soon as browsers stop autocompleting fields marked with autocomplete="one-time-code", won't website developers start marking _all_ input fields with this tag? After all, why do people put autocomplete="off" on input fields anyway?

It's broken as fuck.

We have customer service representatives that accept orders over the phone, including credit card numbers. These should not get stored by the browser as autocomplete data.