I do not agree. Proper OTP token implementation includes client IP check. If you reset password or request auth link, you should click it from the same device (and in limited time). Even if link leaks, it will not be useable, because another person/bot will have invalid IP address.
That’s intended to solve another kind of issues, not unexpected data leak mentioned before.