The item they are fixing is not the password, which already has complexity requirements, and through most systems is rate limited. They are fixing the security

The item they are fixing is not the password, which already has complexity requirements, and through most systems is rate limited. They are fixing the security questions system. And I think they're understating the changes they're going to make. Simply sending a "BTW someone just took over your account" message is obviously not enough -- take it over at 2am and enjoy a night of malfeasance. Instead I imagine they are going to put in some thoughtful patterns like- -emailing the password change notice to the email address on record on the successful completion of the security questions. -having a window before any new password/grants come into effect from such a system. Or the like. As is their proposed improvements don't do much more than what currently exists, where you (apparently) do at least get an email after someone reset your password by exploiting this system weakness.