That is deliberate. Removing a link that would leave the member with no way to sign in is refused with "At least one category one user authenticator must be enabled". To move from one way in to another, connect the new one first, then remove the old one. Connecting password sign-in (local) on the linked-accounts screen is how a Google-only member gets a password.
The rule has two edges:
- The count includes links to providers that have since been switched off. A member with a password and a link to a withdrawn provider can remove the password, and is then left with no usable way in. If a provider is ever withdrawn, keep password sign-in available, and tell members before it goes.
- Only an administrator can remove the Core dna link. This matters only for staff accounts.
Unlinking never closes an account. To close one, an administrator deletes the user or sets its status to disabled.