If your admins change the default away from Authenticator only they see bright red “MS 365 insecure” banners.

So… Its a dark pattern that technically allows other options.