So, to play devil's advocate, 23andMe shouldn't allow credential stuffing to happen by rate limiting logins after so many failed logins, or locking accounts after failed logins.

They could've blocked source IPs making all the login requests, but that was probably being changed to not set off alarms. However, there wasn't enough information in the article to go on, but since they suffered so many breaches of user accounts, they probably had to do something wrong. I'm too busy to dig into the specifics.