[ja27]

Except the article seems to be saying that Apple's two-factor auth isn't required to access iCloud backups and that it only protects account details, payment methods, etc.

[IBM]

Adding two-factor gets rid of the security questions and would have prevented them from getting the password though.