To describe security benefits, we use threat modeling. If there's a threat that's prevented by system A but not by system B, and all threats prevented by B are covered by A, then A is colloquially "more secure" than B.

Here are some threats that are prevented by FIDO and not by TOTP:

- An attacker compromises DNS infrastructure and makes a web page that looks 100% identical to the one you're expecting, hosted on the same URL. They wait for you to log in and use the TOTP you send to authenticate to the real site's servers as you. FIDO prevents this threat (phishing via MITM) entirely, TOTP provides little protection. KeepassXC if you don't use your clipboard to paste TOTPs provides limited protection but the matching is DNS-based, not cryptographic like FIDO is.

- A hacker compromises your computer while it's on and keepassxc is unlocked. With keepassxc TOTPs, they now have your TOTP secret and can impersonate you at any point in the future. With FIDO on a separate non-key-extractable token, they haven't gained anything. Sites can verify that the FIDO authenticator you're using disallows key extraction as part of the protocol, and can even blacklist known-compromised second factors without your intervention.

- A hacker is able to guess exactly 1,000,000 passwords in one minute. They have stolen your password but don't have your TOTP secret. They guess the TOTP using their ability within 999,999 attempts, since that's all TOTP with its default six-digit generator provides. With FIDO, the secret is 128 bits, and they'd be guessing for thousands of years.

I'm not saying FIDO/U2F is "better" than TOTP. They're just different. But you, as a security-conscious user, do get concrete advantages (in the form of protection against particular threats) using a FIDO credential over using TOTP.

Additionally, FIDO doesn't requiring storing a secret key per site; TOTP does.

Ok I can see some points there, though I don't store TOTP in the same place as my passwords.

Can you be potentially tracked across the internet with your single public key in the FIDO system. If my understanding is correct you have a private key no one knows and you provide the public key to authenticate yourself. If you only have one private key and one public key surely your open yourself up to tracking/privacy related stuff? I might be wrong due to my ignorance.

No, each web site has its own public/private key pair, they're just derived from the same original seed (plus scoping information like the user and site IDs). You can't determine if two different users are using the same identifier, although you can determine if they're using hardware tokens from the same manufacturer and batch. U2F's mechanism to check the token is from a "safe" manufacturer provides some information about the token, but not its exact serial number or other unique ID.