Before this incident, protections against that were probably "a good idea at some point, but not near the top of the backlog right now"

There are probably other factors involved, like access to other information used for MFA and compromising those mediums or using information related to them to assume identity.