These 'Security codes' are problematic. WhatsApp servers can force regeneration, allowing to set up a MitM. Users may compare their codes to confirm their channel is secure, but nobody does that.