They could have mandated stronger security. Wouldn't even 2FA have avoided this issue? Or even some even stronger measures like enforcing use of hardware security keys.
By default, we should offer a choice for levels of security. At least a password, with SMS or 2FA. And if the company makes a few bucks, even more options.