Thank you for this, pbug!
I've tested your script and it works, I adapted it to my own needs to also include Software OATH token methods.
Only issue that I found that if one of the users authentication methods is set to their default method, and there are other methods present then it won't remove them.