Given that apparently their previous system simply allowed login/payments without the configured mandatory 2FA, per their statements about the root cause of the issue, this may have been a move of desperation...

My thought is maybe they didn’t really do 2FA, but exploited a password reset mechanism that only required 2FA?

IE: single factor resets, so a compromised “2FA” was actually keys to the kingdom?

But you’d think the attacker would need access to a user’s email or some such then.