But not using hardware based 2FA doesn't make the IT department, completely negligent or incompetent.
Most companies I know if they are using MFA are using Microsoft Authenticator soft tokens through their enterprise 365 environments.
Not requiring MFA at all and having weak passwords would be an example of that.
Phishing is not obviously sophisticated but an argument could be made. The problem with letting that kind of language slide is that it skirts responsibility. Society has a huge accountability problem currently and there isn't really an end in sight. There's no need to continue allowing corporations to use such language and continuing the problem.
If a solution to phishing is available and not used, the easy mode hack is attributed to the security of the people so responsible. They took a risk and that went bad. Fire them(the people ACTUALLY RESPONSIBLE) and move forward with a better model of security.
The person actually responsible is the person(s) who made the final call on using security susceptible to phishing attacks where a better option exists.
If you aren't using hardware auth to authenticate to corporate internal resources, your IT department is negligent or incompetent or both.
I literally have advanced protection turned on for a small four person single location retail operation I am involved with, simply for the PII of a few hundred people that they have to handle. The little USB/NFC fobs are $15.
There is no excuse other than incompetence.