The non 'essential' auth plugins can be deleted until a user is created with that auth type. Once a user has been created they can no longer be removed... even if that user is subsequently deleted.

To reproduce this, you need to configure an auth plugin, add a user (e.g. via LDAP). You will see that the plugin can now not be removed. Deleting the user doesn't make any difference.

Analysis...

The check is made in lib/classes/plugininfo/auth.php in the function is_uninstall_allowed(). The final check is that a check is made in the 'user' table for any user with that auth type. Unfortunately, it ignores 'deleted' users which remain in the table.