Hacker News Reader

>While Bob didn’t have multi-factor authentication enabled, he had also heeded Google’s suggestions to add a backup phone number to bolster security.

Ah, there it is. No two factor turned on.

If he was using SMS for 2FA, he still would have been compromised.

The article states that if 2FA is enabled, then answering a security question or access to the recovery email is also required.