> The vulnerability we're worried about here is an automated attack against many customers of a single hosting provider.

This was an attack against Linode's customer service systems, which allow their support reps to reset root passwords. There's no reason for that system not to be protected by two factor authentication on top of heavy logging.