Compared with something like SMS or email OTPs, I don't think there's as strong a case to make these one-time-use, but the same arguments still apply.
Let's assume that I have the codes printed out on paper. Then during the recovery process, the recovery code passes through all of the following nodes:
- Plaintext: My computer's keyboard, OS, browser
- ENCRYPTED BY HTTPS: browser --> server's TLS endpoint (for ex. CloudFront)
- Plaintext: TLS endpoint --> networking equipment --> application server
- Plaintext: Application server <--> db <--> other internal compenents.
The point is that even with HTTPS, there are a lot of nodes that will have your code in memory (or maybe in logs) as part of the recovery process. If the code is multi-use, then you have to trust that every single one of those nodes is honest and not infected with malware. If the code is one-time-use, then once it's been used, you don't care if it ends up in logs or whatever.
It's not a rock-solid argument, but it's the best I can come up with.