This kind of comment isn't particularly useful because it can get out of date quickly. It's better to give a higher-level overview of what file locations we use and which we prefer.
While you're in here, mind updating this method docstring to include "Args" and "Returns" sections?

I'm thinking if it might be a lot simpler to have a list of legacy paths, which would include the old post-review-cookies file and the home path (assuming that the appdirs path is not just $HOME/.rbtools-cookies). If the appdirs path doesn't exist, we can then scan through the legacy paths and move their content if they exist.

We don't use strings-as-comments like this.

Comments should start with capital letters and end in periods.

These imports are all out of order. It wasn't correct before but now it's worse.
There should be three sections: standard library, third-party modules, and then anything from rbtools. Within each section, we keep things alphabetized:

import os

import six
from kgb import SpyAgency
from six.moves.urllib.parse import parse_qsl, urlparse

from rbtools.api.request import HttpRequest, create_cookie_jar
from rbtools.testing import TestCase
from rbtools.utils.appdirs import user_cache_dir
from rbtools.utils.filestystem import get_home_path

Comments should start with capital letters and end in periods.

This should probably say appdirs_path rather than XDG. XDG applies to Linux but appdirs supports windows/mac too.

Comments should start with capital letters and end in periods.

Comments should start with capital letters and end in periods.

Comments should start with capital letters and end in periods.

I'm not really sure what this means. We're not doing anything with repos.

This new line should be removed.

In this case, we don't want to change it. setup-repo generates a .reviewboardrc file that users should add to their repository. It's separate from the .reviewboardrc in their home directory. That actually probably means most/all of your changes to generate_config_file should be reverted too.

Why this change? appdirs is a third-party module that we just happen to bundle.

This shouldn't be needed.

This should happen adjancent to the check for the one in the home path. The ones from walk_parents need to happen first.
We might want to call this appdirs_path too. XDG applies to linux but appdirs will do the right thing for windows/mac too.

Since you took the "WIP" tag off of the summary, I'm going to start being more nitpicky from here on out.

Your summary and description need some work. See https://www.notion.so/reviewboard/Writing-Good-Change-Descriptions-10529e7c207743fa8ca90153d4b21fea for our guide on how to write these.

appdirs should come before encoding in this list.

There should be a space between the argument name and the type. Inside the parens, this should say (unicode, optional)
This also needs a colon at the end of the line.

This should be:

Returns:
    tuple:
    A 2-tuple with the following items:

    1. A :py:class:`http.cookiejar.MozillaCookieJar` object
       that can load and save cookies to disk.
    2. The path to the cookie file.

For these, let's use a loop. If you recall our last meeting, someone mentioned Python's for/else syntax, which is perfect here:

for path in legacy_list:
    if os.path.isfile(path):
        try:
            shutil.copyfile(path, appdir_cookie_file)
            os.chmod(appdir_cookie_file, 0o600)
        except IOError as e:
            logging.warning(...)
else:
    try:
        open(appdir_cookie_file, 'w').close()
        ...

As mentioned in my other comment, you need to be using appdir_cookie_file here (cookie_file will never have been defined if we get to this part of the code).
Given this and my comment about your unit tests, your existing test cases aren't going through this code path. We should both fix up the tests to generate situations whereby this code will be executed and verified, and also do manual testing for this situation.

Let's reword this a bit:
If we didn't find any existing cookie files, create a new one.

We may not be able to assume that the appdirs directory exists already (unlike $HOME, which we can). Let's do this first:

try:
    os.makedirs(os.path.dirname(appdir_cookie_file), 0o700)
except OSError:
    pass

This test is using files from the user's system. It therefore seems like different setups might yield different results.
The tests should be completely isolated from the system. We should be creating new directories with test cookie file data, and then using kgb to override appdirs methods to point the code to the fake data.

This still needs to be reverted. rbt setup-repo should write to a .reviewboardrc file in the current working directory, not the user's personal config dir.

There should still be two blank lines here.

Capitalize the first letter of this comment.

Please use single quotes here instead of double.

This extra blank line should be removed, because there are still some (extra) imports just below this. There are correctly two blank lines between all the imports and the RBTOOLS_COOKIE_FILE definition.

We should create temporary directories and use kgb to override get_home_path and user_cache_dir to return the paths to the temporary directories. Right now it seems likely that this unit test will end up manipulating stuff in $HOME and ~/.config, which we really don't want.

This file should not be part of this change.

Please remove this line.

Please add a blank line between these two.

Let's update this comment to say "Check for a config file in the home directory", since the appdirs file is also the "user's own config"