If, say, someone were to find my recovery code, could they not then gain access to my account?
As you said, this is only the one factor. That's why -most likely- the recovery codes are simple PINs and have limited time of life. If someone intercept this PIN they have to find out your real password.
Similarly, could then someone not just hack my recovery code, given enough time?
Limited time of life for recovery code is -mostly- for this reason. In the case of someone steal your account's credentials, he/she have a certain time to provide security code. That's a way to limit (not prevent) brute-force techniques.
Consequently, would it not be equally secure to just require a very long, and randomly generated password?
Even if you have a 24-digits password that've been randomly generated, you should think any other security threats that exists (e.g. If someone gain access in your password manager/computer/mobile).
You can find literally tons of articles that describe 2FA (or MFA (Multi Factor Authentication)) scenarios and what are the benefits that provide.
Also, to not confuse you with false sense of security by using 2FA, I better give you a -well known- case that didn't actually worked:
Reddit Got Hacked Thanks to a Woefully Insecure Two-Factor Setup:
Attackers got into Reddit’s systems by compromising some employee administrative accounts for company cloud storage and source code storage. Slowe notes in the blog post that the employees were using two-factor authentication to protect these crucial accounts, but some number of them had that layer of protection set up with SMS—meaning someone would need a code texted to their mobile number to complete an account login. The problem is that SMS-based two-factor is known to be insecure, because attackers can launch a “SIM swapping” attack to take control of a user’s SIM card and all the data coming to their phone number.