The NPM breach was an email that stated the dev needed to update their MFA by the next day in order to keep their access.

If you're arguing that is what ruby central should have done, that's a social engineering attack.