Hm. Apparently I was wrong. They indeed "temporarily" disabled it after the credential stuffing attack [1].

[1] https://customercare.23andme.com/hc/en-us/articles/212196868...