This MitM attack against 2FA doesn't matter (mostly). If an attacker has the ability to intercept plaintext communications between the client and server, they can simply steal the session cookie when it's sent back. The one place this makes a difference is if a 2FA code is required when changing the password or disabling 2FA, in which case the attacker could replay the code to take over the account. Even if replay is prevented though, having the session cookie and password would give an attacker full access to do anything not requiring an additional 2FA code.
To prevent reuse of a 2FA code intercepted by other means (e.g. intercepting sms/email), the server should only allow a code to be used once. This can be done by storing a code and sending it, then deleting the code once used.
For TOTP, replay prevention can be done by storing the last successful authorization window and preventing the code from that window (or previous windows) from being used again. The RFC simply requires one time use without specifying any particular implementation:
The verifier MUST NOT accept the second attempt of the OTP after the successful validation has been issued for the first OTP, which ensures one-time only use of an OTP.
HOTP and U2F prevent replay by design, HOTP by use of a counter and U2F due to its use of a challenge-response method.