from the description, i view it otherwise. the weakness was to base the 2nd factor (2FA) on a channel where the user does not (and cannot) fully control and can be hijacked externally.
it was reported that the attacker obtained an esim QR code without physical verification of an identiy document (which is already the least secure method). Once this was obtained, then the attacker could use it to easily reset secure passwords and take control of the various accounts.
it's a good case study for those who want to secure their accounts, but i suspect it will be unheeded as many prefer convenience over security.