That's great and all, but it's been made clear the exploit would have bypassed MFA, because MFA isn't used to restore backups. This is a tricky problem, since

That's great and all, but it's been made clear the exploit would have bypassed MFA, because MFA isn't used to restore backups. This is a tricky problem, since your phone is probably your MFA device. One easy thing they can do going into the future is once anyone acquires a device with fingerprint ID, allow that as an additional required auth factor when restoring from backup.