Why can his password even be reset remotely, and not something done by other company employees (HR, etc)?

In an enterprise setting where people work in an office I don’t see the point of allowing self-service password resets. It opens you to huge risk for very little upside compared to having to physically walk into the office (if you aren’t there already) and have HR/line manager/etc do it for you.

i mean its easy to say after the fact but i guarantee you most CEOs dont think to do this until theyve been hacked.

It's the same idea though: they could turn off posting via SMS for high value accounts.

no once they pwn your number its a 2FA vector so they get full control