What's the best way to unsubscribe someone from ALL business units using code?

What I would recommend using, due to its versatility is LogUnsubEvent.

Although it is created to handle job specific events and BUs, I find it is the best option because if you leave all of that off, it will master unsubscribe.

Find more info on LogUnsubEvent inside this article I wrote as well as one that Zuzanna wrote that includes how to do it in multiple SFMC languages.

My recommended WSProxy script:

<script runat="server">
    function LogUnsubEvent(mid,skey,emailaddr,jId,lId,bId,unsubReason) {
    var prox = new Script.Util.WSProxy();

    /* Set ClientID */
        if(mid) {
      prox.setClientId({ "ID": mid}); //Impersonates the BU
        }

    var props = [
       { Name: "SubscriberKey", Value: sKey },
       { Name: "EmailAddress", Value: emailAddr },
       { Name: "JobID", Value: jId },
       { Name: "ListID", Value: lId },
       { Name: "BatchID", Value: bId },
       { Name: "Reason", Value: unsubReason }

    ];
    var data = prox.execute(props, "LogUnsubEvent");
        return data;
    }
</script>