It didn't sound to me like the attackers were getting past 2FA, but rather that they were setting up new accounts with the same profile picture. That wouldn't require an attack or compromise at all.
Maybe I'm reading it wrong though.
Facebook has a trusted devices feature where logins from that device will not require 2FA login. Maybe the hacker is using such a device. Could be an sold smartphone/laptop or maybe a public computer.