I read the article that you linked and the ARS article referenced. Interesting stuff and proof that with persistence that things like TOTP can be sidestepped. Hardware tokens aside (the saving grace in the Cloudflare example) it's possible that malware can intercept not only passwords typed on a keyboard, but the TOTP codes typed in as well.
Mark has been saying for years that Zerify Defender can prevent keystrokes from being intercepted by malware. If that's true, then Zerify technology sounds legit.
So why hasn't Zerify been able to capitalize on that technology?