Introducing security defaults

I am a bit confused by @malcolm_cnx 's comments.  We have various Business Essentials and Premium accounts in a tenant that we purchased through GoDaddy (a mistake), and we have enabled Security Defaults through the Azure Portal.  I do not see that under Users there is even a choice Active Users, much less a further menu choice Multi-Factor Authentication.   Rather, after choosing a user, there is an option called Authentication contact info, and then a link Authentication Methods.  Clicking this allows me as admin to enter user's MFA phone numbers and email addresses.

This in itself is confusing, because Security Defaults is supposed to require the Authenticator app, and not allow MFA through phone texts and emails.

Could someone please tell me what is going on here?  Does Security Defaults actually work?  Does it require MFA for all users?  Do I have to take an additional step to enable MFA for all users after turning on Security defaults?   How would I do that?  Why do the options I see differ from the ones malcolm_cnx is reporting?

Just trying to avoid more compromised users.  Thanks.