not really understanding your point in both instances the hacker or the attacker is the responsible one not the victim. but the user in 23 and me could use basic password practices to prevent this form of attack.
in the street, there's no clothing that can keep you safe
but I agree with sensitive data 2fa should be mandatory