This is not what happened here. 23&Me exercised poor security. I deal with financial data for my job, (like, transactional data, for most Americans), and I would consider that less sensitive than DNA data. We lock that transactional data up so tight it'd make your head spin. If it's data about an individual, in the wrong hands, it can do harm. If you're in the business of people's data, you cannot be stupid about protecting that data. 23&Me is (was) very much in the business of people's data, and could afford and attract the best talent to ensure the data was encrypted and protected.
They're reaping what they sowed.
The bad guys obtained user passwords from breaches at other sites where some 23andMe users had accounts and had used the same email and password as their 23andMe account. They logged into those 23andMe accounts and obtained data that those accounts had access to.
What looks "normal" depends on the org, but 23&Me knows what it is (or should, since it's a fundamental of running their business).
Just as a made up example, they may know that 85% of users don't use VPNs, and typically have an IP address that geolocates within 100 miles of their mailing address (which 23&Me has on file). Users might also typically log in very infrequently between 12-4am (localized to their IP/mailing address). And when they do log in, 90% of the time it's to see the new content you just sent a marketing email about, with short session lengths as well.
A user who logs in through an IP that geolocates well outside of their mailing address and methodically steps through every possibly thing you can click on at 3:15AM, is probably a bad actor who gained access through credential stuffing attacks.
Off the shelf tools can automatically detect all of that kind of behavior, and more. They can look at the collective traffic patterns and see a bunch of users logging in from the same pool of IPs, or the same VPN, or around the same time, or using the site in the same way as others bearing similar attributes. They can stop wide spread coordinated attacks from botnets.
The same tools can automatically detect and alert when credential stuffing attacks are happening, locking down accounts and requiring their passwords to be reset.
Given the scale at which 23&Me operated, it's impossible that they weren't aware of these tools.
Investing in the right tools is just one of many things they could have done. Even with those kinds of tools, you need to assume they're not enough (even if they are), so you encrypt everything at rest. Every decryption gets audited, and audit logs get fed into the same monitoring tools used to alert and stop abnormal behavior.
It all sounds overkill, but remember: they lost 91% of their valuation. All it took was the wrong people getting in, and it tanked their entire business.