These two forms work better because they are not run SEVERAL TIMES (which you can see with udevadm monitor --property --udev )
ACTION=="remove", ENV{SUBSYSTEM}=="hidraw", ENV{ID_FIDO_TOKEN}=="1", RUN+="..."
ACTION=="add", ENV{ID_FIDO_TOKEN}=="1", RUN+="..."