I just enrolled in advanced protection, and was then able to unenroll without 2FA re-auth....

I agree that requiring 2FA re-auth on trusted devices to disable 2FA would be a terrible default for users with only one method, but Advanced Protection should do more.