Without getting into all of that too much, MFA worked where it was supposed to and there was never access to the accounts in question. Which is kind of Linus' point in the video; it shouldn't be so easy to do the damage that was done just by stealing session data, and never having (and YouTube never requiring) actual access to the accounts to do the things they did.
Breaching security to the extent that it was at Linus' end wouldn't have amounted to anything at all if YouTube's end actually required what it should.