A 2FA bypass would mean you can completely bypass the TFA protections. His attack doesn't allow that - you still need to steal the OTP somehow. It's only notable in situations where you can steal OTPs but for some reason only after they have been used. That does not seem like a likely scenario so I'd say it is low priority.

Still, it's definitely an embarrassing flaw and probably trivial to fix so taking over a year to fix it is not great.