According to NIST's memorized secret (aka password) guidelines [1]:
> When processing requests to establish and change memorized secrets, verifiers SHALL compare the prospective secrets against a list that contains values known to be commonly-used, expected, or compromised.
If Zoom had enforced that passwords can't be from a list of already compromised passwords as this guidance suggests, this attack wouldn't have been nearly as successful. This is just what happens when you don't have a decent security policy, and everyone that doesn't follow basic security best-practices should be called out for it.