Linus is weird because he employs some really competent people but is only a few rungs above a Geeksquad computer janitor himself and this bleeds into their organization. Most places would establish process controls and domain policy to limit these things from happening. I had to laugh when they lost all of their production videos awhile ago because they were running a raid 0 SSD stripe with no backups, it's a definitely a fly by the seat of your pants company.

That said, MFA wasn't an issue here and no admin access is needed to steal a session token. He's right that Youtube itself doesn't make content management easy for organizations.

Bonus points to Tech Jesus texting him at 3:14am to alert him first!