I mean, I'd argue that it is safe BECAUSE of the 2 factor auth. It did exactly what it was supposed to, no?
The two-factor did but as I said, it's still just an option on Coinbase. Luckily I had it turned on.
I'd expect more out of their site security though. My password was pretty difficult but that didn't seem to matter at all.