So now we're playing a semantics game about what the word "hack" refers to in this context? users gained unauthorized access to 23andMe and used that access to get access to data, and 23andMe had full control of mitigating, monitoring, and preventing this type of attack. Is that better? Doesn't really change my salient point at all.

In your example the site is fully capable of preventing weak passwords or enforcing things like MFA that make this type of attack a lot less effective. It may surprise you to know that most websites already do this!