Are you saying that the Backup Codes status box in your screenshot should be hidden until TOTP is setup? So that when a new user visits the page, it'd look like this?

...or just that the box should be disabled / not clickable?

Once they're on that screen, requiring them to check the box before the codes get saved isn't currently possible because of WordPress/two-factor#507, but I'd like to implement that once the upstream issue is resolved.

Related:

• Only allow backup codes when another 2FA method exists #21 / Check user has a desired provider set #24
• Disable backup codes UI until primary provider enabled #47
• Draft MVP launch post #50 (comment)

I mean more on this screen:

checking the box takes me here:

I don't think simply checking the box is sufficient to confirm the access the codes.

For example, on WordPress.com, we have a next screen that asks for one of the 10 codes generated to confirm that the person copied/printed them.

Ah, I see! Yeah, I think that's a good idea 👍🏻

Part of this is caused by / limited by WordPress/two-factor#507 - The backup codes are already saved and in-use before the checkbox on that UI is selected; they're saved at generation time.