"This is an application built with least privilege in mind to ensure that support engineers are granted only the specific access they require to perform their roles. They are unable to create or delete users. They cannot download customer databases."
not being able to create or delete users seems a far cry from "near full admin access."
But at least changing passwords of existing accounts seemed possible according to the screenshots, perhaps disabling 2FA as well.
As long as Okta does not provide a list of what the user was able to do, we don't know
I can't see any place in the screenshots where they are setting a user's password, only sending reset links (which would do nothing if the support user does not have access to system email or end users email).
Also at my workplace, 2FA is not enforced by an IdP (like Okta), but by our own application (and therefore could not be disabled at the IdP level).
As others have mentioned, the slack access is potentially more concerning.