Look, I'm as ready as anyone to jump on companies for mishandling data. I work daily with extremely private medical information protected by an ungodly amount of laws, and it pisses me off how whimsical most companies are with customer data. This one wasn't exactly their fault though. If you use the SAME EMAIL AND PASSWORD across multiple different sites it's not site B's fault when site A gets hacked and your login information is attempted on site B. It's also not even that surprising given people willingly giving up information this private aren't exactly the most privacy literate.
Could they have enforced multi-factor 2FA? Sure, and it would've mitigated some of the damage. However, I think we can all reason that they probably had the same password for their email and phone provider. Hardware keys aren't cheap, and most people just don't have them. It's also pretty reasonable that it would take a super long time to figure out someone logging in with a username and password was "hacked".
Not to mention people saying, "just ignore every major metro in the US which happens to make up a majority of the population" in response to housing being expensive is ignoring that most people are dealing with housing being way too fucking expensive. Like sure if I go buy a plot of dirt with a house 2 hours from a major population center then of course it'll be affordable. Too bad there's 0 jobs out there and 0 reason to live in the sticks for most people.
274 million people live in or near population centers, with only ~57 million living in rural areas. We can't just ignore that the places with most of the people are becoming unaffordable due to draconian zoning policy and lack of government push for more housing.