Thanks for this report! This has since been cleaned up by T407057: Run MoveRecoveryCodesFromTOTP.php, which combined all user's old-style (TOTP-associated) and new-style recovery codes. As a result, some users now have 11 or 20 recovery codes instead of 10, depending on when they first visited the new Special:AccountSecurity page. The combined set of recovery codes is now consistently displayed in all places where recovery codes are displayed, and is the full set of recovery codes that will work to log in to your account.

To respond to the 3 points in the task description:

1. The software is apparently trying to show me the recovery codes associated with my account, even though I was previously told by the software that the recovery codes would "never be shown again" after they were displayed during the initial 2FA setup. (I don't know if that presents any sort of risk or not -- I'd assume not, given that I assume this new behaviour is intentional; but as an end-user who's previously been given the "never be shown again" message, it's certainly unexpected.)

This behavior has indeed changed, and we now do display recovery codes and allow users to copy/download them after they were created. There's some discussion of that on other tasks: T408759 and T354030.

2. The recovery code I'm being shown is one that I've personally never seen before. As an end-user, I therefore wonder how it's been generated? / why it's been generated? / whether I need to download it (and add it to my already-saved list of recovery codes) or not?

This happened because we separated recovery codes from the TOTP authentication method (which was necessary so that users with only non-TOTP methods would also get recovery codes), but we had not yet fully migrated the TOTP-associated recovery codes to the new recovery codes system. The new system then generated 1 new recovery code for you when you first visited Special:AccountSecurity. We later increased this number to 10, so users who first visited Special:AccountSecurity after that got 10 new recovery codes.

3. The recovery codes that were previously generated when I originally enabled 2FA aren't shown in this list. As an end-user, that leaves me unsure & slightly worried as to whether my previous recovery codes have been unintentionally deleted / will still work or not. (I've since tested one of them, and it did seem to work; but prior to testing it out I genuinely wasn't sure if this would be the case.)

I understand this concern and I'm sorry that we made this confusing. The TOTP-associated recovery codes always worked for login, but they were not displayed in the list of recovery codes until we completed the migration in T407057. TOTP users who visited Special:AccountSecurity shortly after it launched received 1 new recovery code, and after the migration they now have 11. TOTP users who visited Special:AccountSecurity a little later (after we increased the number of recovery codes to 10, but before the migration) received 10 new recovery codes, and now have 20. Users who visited Special:AccountSecurity after the migration, or who never visited it at all, or who were using WebAuthn instead of TOTP still have 10 recovery codes. (Some users who set up TOTP many years ago received 5 recovery codes at setup time, they will still have 5 codes, or they could have 6 or 15 if they visited Special:AccountSecurity in October.)