It's definitely suspicious. However, often it's not enough to trigger any alarm bells. It's fairly easy to mindlessly type in password/2fa codes into a website

It's definitely suspicious. However, often it's not enough to trigger any alarm bells. It's fairly easy to mindlessly type in password/2fa codes into a website ("stupid google asking for my password again") rather than automatically think about a potential phishing attack. While I haven't see it reported whether or not they had 2fa enabled, we can hope that they had taken this very basic security measure. Actually one of the best preventions against this is using a password manager. I was nearly caught by a phishing site once, and I only noticed because 1Password was refusing to autofill the password field.