“Well, so the question becomes: How do we prove the phone contains that static secret (e.g. that password: $3cr3tP4$$) without ever disclosing it?”
The six digits on your phone are derived from a secret that both the phone and the server hold. There is no network call and no magic, just a hash. That also means the server keeps a copy of your second factor. Anyone who steals that database can generate your codes too.