tl/dr: One time recovery codes give account owners an option for regaining lost access. People who consider this an additional risk
can always ignore it or destroy it, but people who are worried about
losing access to critical services can certainly come up with a secure
way to store it. As a result, it's a good option to have for services
that may be critical to businesses and/or people.
There is no secure
In most of the systems I've seen that have one time recovery codes, they are an optional feature. As a result, they give the account owner a way to mitigate competing risks.
When it comes to security, it's always important to remember that there is no such thing as "secure", only "secure enough for me". Different companies and people have different risk tolerances, different threat models, and different concerns.
Mitigating denial of service vulnerabilities
From that perspective a one time recovery code is a mitigation against a very particular kind of denial of service vulnerability: faulty (human) memory. In some services, if you lose your password, you are effectively locked out of your account permanently. In some cases you may fix this by getting a new account and suffering the inconvenience of having to set it up again. In some cases this may destroy your business. If a particular account falls in the latter category then you probably don't want to risk forgetting the password and losing access.
One time recovery codes are obviously designed to address that (and other kinds of events that may cause you to lose access). You may decide that printing a one time recovery code on a piece of paper and putting it in (for instance) a bank safety deposit box is a good way to mitigate the risk of lost account access without increasing the risk of account theft.
Then again, you may decide that you aren't worried about losing account access and so you may "print" the one time recovery code from the site and then immediately throw it away/burn it/never actually write it down/never actually request it in the first place. After all, if you don't have it, then you don't have to worry about accidentally leaking it. In this case, you are deciding that the increased risk of account theft via the recovery code is not worth having an alternate means of access.
From the service provider perspective
The whole point is that you get to decide whether or not you wish to make use of this feature. Many sites I have seen it make it optional, but even if it isn't, you can destroy it easily enough. However, as a service provider, if I provide the kind of service that may be critical to running a business, then I probably have some customers who want to have an alternate means of access in the event of account lock-out. As a result, it makes perfect sense for me to provide this as an option.
Certainly, this will save me a lot of trouble when I start getting frantic emails from people who claim to have lost access to their account. Telling the difference between "I lost access to my account" and "I'm trying to use social engineering to convince support staff to give me access to someone else's account" can be surprisingly tricky. If I build options that give my customers the self-service options to recover their own account, then that gives me less support requests to handle and also decreases my legal liability (since if I accidentally give away an account to an attacker I will definitely be held liable for it).
Moreover, since these are features that will be used rarely, the provider can make extra protections around it. You would certainly put in protections against people trying to brute force recovery codes, although I don't think that is a real concern anyway. Every recovery code I have seen are long and random enough that they would be immune from brute force anyway. In general though, the concept itself is perfectly valid. Whether or not a particular provider may have implemented an insecure implementation of one time recovery codes is another matter.
Finally, adding recovery codes doesn't make it easier for a provider to access your data. The provider can already do that anyway, and will do that if requested by law enforcement regardless of whether or not you have a recovery code. In the case of services that are designed so that the provider cannot access your data (for example a password manager), then they would have designed the recovery codes so that they are also inaccessible to the provider. As a result, recovery codes do not generally create an additional risk vector for internal attackers.