Email is commonly compromised. It's an easy target for bad actors executing a takeover.

The email protocol, SMTP, was originally not designed with encrypting content in mind. Encryption was added years later, but as an option that is negotiated between mail servers.

While large email providers like Gmail, outlook, etc. likely all support encryption as best as they can, all it takes is one misconfigured server, etc. to cause emails to be sent in clear text at least part of the way from location to another.

It’s largely for that reason why a lot of people & organizations don’t trust email to be secure unless you use mail clients that encrypt and decrypt mail at both ends. But that’s a PITA to set up properly and manage.

If your email is sent entirely within an ecosystem like Gmail then it’s likely encrypted the entire time. But as soon as it passes outside of Gmail to another organization there’s no guarantee it’s still secure. These days it probably is, as virtually every reputable internet provider & company is going to take the issue seriously, but there’s still the history of SMTP not being encrypted that haunts those in the security fields.

Because Two-Factor Authentication is generally supposed to be under the principle of "Something you have and something you know", the password being the "know", and using a TOTP on an app via your phone would be the "have" (the phone).

I suppose if your email is restricted to the something you have/know it's a bit better, and certainly better than nothing - but not by much.