Wasn't that more social engineering and password guessing though? Nothing they can do there apart from more security layers in the password/login but people will still not use string passes and be suspectible to social engineering.

After that they did exactly that, they included multi-factor authentication when it was previously unavailable. The MFA available in 2018 is dramatically better than it was in 2014, when I believe all that occurred.

Companies that don't protect unsophisticated users from simple mistakes or inaccurate mental models will get a reputation for being insecure and lose sales. This is regardless of whether the user "should have known better."

Their iCloud service was susceptible to brute force attacks.

That was caused by stupidity - reckless password management on the victim’s part.

Not really. Apple had no limit on the number of times that you could input a password incorrectly. They brute forced it. That's on Apple.

True, but I won’t put all the blame on Apple here. A good, random 30-char password would be impossible to crack even with thousands of attempts per second.