Did you read the article? Not only was sql injection found, logins were brute forced. 2fa absolutely would have helped with that.