Restrict Access to TOTP Authenticator Key

Correct, the TOTP master key is the 2nd factor and must not be accessible to users, I do not understand how security product exposes it to the public.