3 ms·

Even if they didn't want to do 2FA for whatever reasons, there are things they could have done like checking password hashes against breaches.