I think "ideally" you print out the codes and physically secure them somewhere, so the risk isn't high. Recovery codes aren't about safety from being hacked, they're about mitigating the risk of you losing your 2FA code device.

In practice, 2FA is just another password anyway. What it really helps with is password reuse.