It’s a drastic operation and we want to make sure people integrate it into their existing systems with care and thought. People should make sure it matches their own organization’s standards for GDPR compliance.
As for your code, you needn’t call user.save as the anonymizer class does that for you. The code should still work though. How did you confirm that it did not?