I agree with most people that calling to reset password should be a service that can be entirely disabled, or at least require 2FA.
But think about this. All of this could have been avoided if they had the simple policy of calling you back. The only thing you would have to do as a user, would be to keep your number up-to-date.
Of course this also requires that you should never be able to add a number using the phone though, but this makes sense, since they can just say: "To do that you just have to sign in and click on..."
No! It's the companies who buys and USE this crap, even when they are configuring the devices and see that they cannot protect them, that needs to be held accountable.
It's like buying a bus with broken brakes, and still use it as public transportation. Nothing wrong with buying the bus.