Key is rightnhere...”But Apple did add additional steps to keep hackers out of user accounts, and it launched a campaign to encourage users to take stricter security measures”
All that does is notify a user that someone, most likely the user himself, is trying to change a password and prevents any further progress until the passcode provided by Apple, sent to a known device owned by the user is intput before proceeding with any changes to the account. It would prevent what happened.
The "Fappening" was a typical phishing expedition event. Nothing more. There is no "key" here except in your own delusional mind that desperately needs to have Apple iCloud defective in some way.
Even the FBI states that is what happened here. . . the Search Warrant Affidavit even defines Phishing as part of the request and reasons for why they needed the search warrant.
The facts of this case are that not one original password was ever "hacked" to gain access to the iCloud accounts. No one broke into iCloud by brute force breaking of anyone's passcode. No one found a backdoor. They used phishing to persuade the owners of the accounts to provide the password voluntarily, or the miscreant discovered the answers to the owners security questions by research and merely changed the users original password.