Why is the "Require email OTP for COD" option greyed out?

That option only works when risk scoring is on. Go to Orders → Fraud Protection:

1. Tick Enable risk scoring at the top.
2. Under Cash on Delivery, tick Require email OTP for COD.
3. Click Save settings.

From then on, a shopper who chooses Cash on Delivery gets a 6-digit code by email when they place the order and must enter it, click Verify, then click Place Order again. The shopper also needs to fill in a phone number. They can use Resend code if it doesn't arrive.

To stop asking for the code, untick Require email OTP for COD and click Save settings while risk scoring is still on. Switching risk scoring off alone doesn't turn the OTP off.