Why not?

GoDaddy is a valid domain registrar. The customer had dual MFA set up. The customer did all the right things.

I’ve never heard of Godaddy making this kind of egregious mistake before. I’ve heard of some doozies, sure, but nothing like this.

Don’t blame the victim. “It’s their fault they got robbed, they left their door unlocked” is not a valid response to a situation like that or like this. The robber still stole, and godaddy still broke their own rules, rules that customers pay to have enforced.

When you find yourself victim-blaming, you will find yourself on the wrong side.