I don't know what the Google Authenticator team was thinking, if at all, when they did that deplorable implementation of the sync feature.

One click on the "backup codes" on main screen and boom, no confirmation or anything. Your keys are in the cloud. I couldn't find a place to undo it. Article says it's enabled by default now. This is shameful.