We do not know that the attacker did not have access to the TFA code. That's an assumption. For all we know, it was the customer's roommate reading the SMS off

We do not know that the attacker did not have access to the TFA code. That's an assumption. For all we know, it was the customer's roommate reading the SMS off his phone and sharing it to the pirates. It is certainly possible that Uber's TFA system is compromised, but that's not the only explanation.