Yes, Nest has offered MFA for years. The blame for this incident falls squarely on the user, who reused the same (weak?) password across multiple websites without enabling MFA.
One the one hand I agree the specific issue is the user fault. On the other hand, you're selling internet controlled audio and video recorders to the general public. What did you expect?
Every single day people crash cars, cut themselves on kitchen knives, and choose weak methods of single-factor authentication. There’s only so much the seller can do. We’ve seen how much users love (and subvert) “strong password requirements.”