In this particular case I feel like it's a bug that backup codes are not treated as secure as 2fa codes, and that I need explicitly a 2fa code to disable 2fa is just broken (in my specific case)
I used this horror story to move to Aegis from Authenticator and make an encrypted backup copy of the OTP vault, so thank you for posting. FWIW.