A supermajority was required. The attacker purchased enough LP tokens to secure one. At the moment of the attack they held about 70% of voting power.
Unanimous voting wouldn't have been particularly useful because it would never be used. You can't ever convince every last investor to log in and pay gas to vote on a governance measure.
There was a protection in place, which was that the measure must be up for 24 hours before it can be passed. But the critical flaw was that the contents of a measure can be swapped out by a supermajority token holder, even after the 24 hour cooldown period. The attacker threw up 2 measures, one pointing to a nonexistent contract address, and another dummy measure as a diversion that would have transferred $250,000 to Ukraine and $10,000 to a wallet they owned. The diversion worked, and everyone spent the 24 hour period discussing why someone thought they could hoodwink the LP token holders into swindling $10,000 from them, and more or less ignored the second measure. Then, during the attack, the attacker deterministically created the treasury liquidation contract at the formerly blank address and used the flash loaned supermajority to pass it.