TheCaconym [any]

While SHA1 might be considered problematic security-wise in terms of collision (using it for certs today would be very bad, for example), it is not problematic in terms of preimage attacks (even MD5 isn’t broken that way IIRC), which is what truly matters in the context of 2FA / TOTPs

As for “why not SHA256”, compatibility

If you answer at least try to address the point

Spotify is a DRM-infested despicable hellhole

And one that platforms fash or fash-adjacent imbeciles