This doesn't sound right, and the Twitter thread is devoid of much detail as to the root cause here. Last I checked, HSBC had a physical code generator that had to be involved in approving transfers, so how were these transfers (150 of them!) actually made?
So, was this actually APP fraud? (in which case - let's not beat around the bush here - it's almost certainly the account holder's fault, but obviously things are less black and white when the account holder is vulnerable). Or was there actually a flaw in HSBC's account security which allowed criminals to gain access to the account?
None of these facts excuse the poor customer service, but there's generally good reasoning that these cases are dealt with by a dedicated fraud team and not by random staff in branches. There needs to be more regulation to ensure that they're staffed appropriately and victims aren't left in the lurch, though.