true, but in this particular case 2FA was not preventing this man from stealing user's cryptocurrencies. he just chose those accounts without 2FA because it was more convincing to lie and say they were hacked compared to saying an account with 2FA was hacked!
the moral of this story is not to trust any exchange with your money. the coins are in their database and no matter what password and 2FA you choose they can still rob you.