Define two Authenticators for a CO.

Create an enrollment flow and tick the box to establish authenticators.

Set both of the authenticators to "Not Permitted".

Save the enrollment flow.

Now edit the enrollment flow and change one of the Authenticators from "Not Permitted" to "Optional". Save the enrollment flow.

The configuration does not change, which can be verified by looking at the database.