It wasn't millions of accounts, it was an undefined number relying on scraping dna relatives after the breach. This article mentioned it, but last week I saw a better more detailed explanation.

Regardless, the key quote from the linked article:

"23andMe blamed the incident on its customers for reusing passwords, and an opt-in feature called DNA Relatives, which allows users to see the data of other opted-in users whose genetic data matches theirs. If a user had this feature turned on, in theory it would allow hackers to scrape data on more than one user by breaking into a single user’s account."

And even if it is true, that is still the fault of 23andMe. It is kind of a fool me once scenario. Some occasional password stuffing is excusable and can be blamed on users' laziness. Millions of accounts hijacked through password stuffing and something is fundamentally wrong with 23andMe's approach to security for not identifying such a large scale attack.

Related: what fool decided to call compromised credentials "stuffing"? Nothing is being stuffed.