Users being prompted for phone despite methods being disabled

Recently we pushed a change to disabled authentication with anything except MS Auth app, software OATH, or FIDO2. Despite this, some users (no discernable correlation between them), are being prompte...