Haven't read the article, don't know anything about their network. Assuming they use a Windows domain for their corp infrastructure.

Lower level Windows authentication mechanisms can't be configured for 2FA. If your active directory domain is functional at all then at the very least your systems need to be able to talk via SMB and ldap to a domain controller. With sufficient privileges you're able to execute code on other machines via either protocol.

You only need an infected machine, not even user credentials, to be able to perform password spraying or kerberoasting attacks.