I just now added my personal email as a recovery to my work email to test this. It is opt-out.

> Subject: "Someone added you as their recovery email"

> Someone added <mypersonalemail>@gmail.com as their recovery email

> <myworkemail>@<myworkdomain>.com wants your email address to be their recovery email.

> If you don’t recognize this account, it’s likely your email address was added in error. You can remove your email address from that account. Disconnect email

The "Disconnect email" at the end is an opt-out link.

Having to actually type in a code sounds like a smart move on Google's part, to avoid spear-phishing and XSS attacks.