It works in the inversed order too, e.g.:
Login to horizon, and use the same token at wikitech
I don't know, how long this is possible, but it has a big abuse potencial: Steal the 2FA token from a user, login into the other instance, and change his settings.
It's supposed to do this, it was discussed in T105690 (which can probably be made public now)
I think what @Luke08151 may be saying is that mediawiki prevents the replay of OATH tokens, but if you replay the OATH token in horizon, then it works fine.
We could have horizon also check the same system for replayed tokens that mediawiki uses, but then horizon needs access to mediawiki's cache.
I think this is fixed -- Horizon now uses the mediawiki 2fa plugin for verification, same as wikitech.
The MediaWiki code used for this was developed in T144712: Check for 2FA protection and enforce validation of 2FA tokens to support 2FA in Striker. Tokens are now validated by MediaWiki's OATH extension directly using a privileged API endpoint which also maintains a single cache of consumed tokens to prevent replay attacks.