If you can get at a password by hacking a website, I wouldn't be holding out hope that they couldn't then steal the TOTP secret.