The nrfutil device recover triggers CTRL-AP.ERASEALL, which is available regardless of the AP-Protect status.
The nrfutil device erase connects to the selected --core access port (application if none specified) and triggers an ERASEALL register operation for most device families. The operation can be interrupted if the access port protection (AP-Protect) is enabled.
Note
For the nRF54H Series, nrfutil device erase and nrfutil device recover both trigger the ERASEALL boot command over CTRL-AP.