Why do many authenticators take a random challenge or the current time as an input value?

The input value makes every output unique to one login, so an output that an attacker intercepts cannot be replayed later.

If the output only depended on the secret, it would be the same every time, and seeing it once would be enough to impersonate the user. Feeding in something that changes solves this:

• Challenge-response: the verifier sends a fresh random number (a nonce, "number used once"); the authenticator signs or MACs it with its secret. The verifier checks the result and knows it was computed just now, for this login.
• Time-based: the input is the current time window (TOTP authenticator apps), so each code is only valid for about 30 seconds.
• Counter-based: the input is a counter that increases at each use (HOTP tokens).

This property is called replay resistance. It does not stop every attack: a phishing site can still relay a fresh code in real time, which is why phishing resistance needs an extra binding to the real website (see the phishing-resistance card).

Go deeper:

• NIST SP 800-63B-4: Replay resistance — the requirement and how nonces and time windows provide it.
• Cryptographic nonce (Wikipedia) — what a nonce is and where it is used.