How to: Enabling MFA for Active Directory Domain Admins with Passwordless Authentication

Microsoft will literally do anything except give us a simple universal TOTP method (or using the Authenticator app) for on-prem second-factor authentication.  I just don't understand this.  Passwordless is controversial.  I know Microsoft prefers it, and there is data to support it being better than passwords.  But it is not the industry standard.  Password + TOTP is the standard.  Why we can have this in Azure but not on-prem is the biggest mystery of all.