I find this subject interesting because it isn't as cut and dry as it looks. The problem is attackers took data and leaked passwords from previous breaches and then were able to access an account. The question becomes what should 23andme have done in the first place?

You provided a valid password and username so why wouldn't they grant access?

Now being able to harvest a bunch of other people's data after is more problematic but I find it an interesting edge case as 23andme performed the function they were supposed to of allowing access to an account to people that had credentials. Should they have forced MFA? Where does the users responsibility for choosing appropriate passwords and an organizations responsibility for deciding of their own volition not to let someone in, end and begin?