We used Wordfence (or Two Factor) for two-step sign-in. Does everybody have to set it up again?

No. Settings → Bring second steps from another plugin lists the people who set up an authenticator app with Wordfence, Wordfence Login Security or Two Factor, and Bring them over copies each secret across, so the app on their phone keeps working with no new QR code. It works with the other plugin switched off, changes nothing of the other plugin's, and leaves anybody who already has a second step here alone, so pressing it twice does nothing the second time.

Recovery codes do not come across. Until each person has made ten new ones, every page they open in wp-admin (or My Account, on a shop) says so and links to the button on their profile (or the Two-step sign-in tab), which asks for their password and shows the codes once. Passkeys and email codes have to be set up again here. Once people are brought over, switch the other plugin's second step off, or they are asked for a code twice. From a terminal: wp login-security two-factor import --from=wordfence --dry-run.