They gained access to the Google account by stealing the verification code over the phone, but then they had easy access to other accounts (e.g. coinbase) becau

They gained access to the Google account by stealing the verification code over the phone, but then they had easy access to other accounts (e.g. coinbase) because they had access to 2FA codes because Google authenticator was backed up to the users Google account.