MFA is extremely vulnerable to fishing, ie. man-in-the-middle. It is pretty useless, hardware token or not. U2F/webauthn mostly fixes that.

The Reddit hack in question phished the user-input MFA (presumably TOTP) string.

My point being is that by not having hardware based MFA, but still have a form of soft token MFA doesn't make the IT personnel completely incompetent or negligent.

Not requiring MFA at all and having weak passwords would be an example of that.

Then why are they still getting owned via common/routine phishing attacks? Ones that are entirely, cheaply, and easily preventable?

Because they don't pay a competent person to do their security or because the person they paid isn't able/willing to make decisions.

Phishing is not obviously sophisticated but an argument could be made. The problem with letting that kind of language slide is that it skirts responsibility. Society has a huge accountability problem currently and there isn't really an end in sight. There's no need to continue allowing corporations to use such language and continuing the problem.

If a solution to phishing is available and not used, the easy mode hack is attributed to the security of the people so responsible. They took a risk and that went bad. Fire them(the people ACTUALLY RESPONSIBLE) and move forward with a better model of security.

The person actually responsible is the person(s) who made the final call on using security susceptible to phishing attacks where a better option exists.