The “Set up” button on your Security page did nothing. Pressing it showed a message about allowing pop-ups and no set-up ever opened. The fault was in the browser, not your account: we asked the browser for a new tab a moment too late for it to count as something you had clicked, so it was blocked. It opens properly now, and if your browser still refuses a new tab it carries on in the one you are in rather than doing nothing.
You can also set a method up again without removing it first. Replacing an authenticator on a new phone used to mean deleting the one you had and having no second step at all while you set the new one up — which is exactly when you are most likely to be locked out. Every method now offers “Set up again” next to “Remove”, and you can add a second, different method as well.
Changing any of it now asks you to confirm it is you. Being signed in is enough to look at your security settings and no longer enough to change them: turning two-step verification on or off, adding or removing a method, or generating a recovery code will ask for your password, and for your second step as well if you have one. Sessions can be long, laptops get left unlocked, and these are the settings that decide whether you can be locked out of your own account. Keep a recovery code somewhere safe — it is what gets you back in if you lose the phone holding your only method. Open your Security page