Is credential stuffing even hacking?

It's super lame that the company doesn't enforce 2FA.