It seemed very chaotic to me. As
BWolff (WMF) stated, they're still investigating the matter and we're all shortly expecting a report from the WMF with more details. At the moment, we know very little other than the fact that it doesn't appear to be a brute force attack nor backdoor access to the WMF servers and, in at least one instance, the password was unique to Wikipedia. I was admittedly surprised that 2FA was implemented so quickly after the incident. I can only assume it was something already being worked on and simply rolled out a bit sooner than to be expected. In any case, I think the community responded quickly to minimize the damage and I'm sure this situation will lead to further steps that improve account security. I think the WMF did exactly what it needed to do by taking the matter seriously and giving us the tools to start improving our security situation. I absolutely believe policy changes need to be implemented to ensure these measures are actually used. Account security is only as effective as its end user. Ideally, I'd want the adoption of increased password complexity requirements, and for all users to use SHA-1 committed identities, 2FA, and scratch codes. I'm not sure if this pain-point would be worthwhile for all editors. I do not think it would be a stretch to make these measures compulsory for admins, bureaucrats, and other functionaries. As BWolff (WMF) said, there would need to be community consultation but I would hope that they/we would be willing to take on a bit more inconvenience to mitigate the potential damage that can be caused by our tools when in the wrong hands.
[Edit: I've been thinking about this answer a bit more now that we have some more
information. We still don't know the full extent of the situation or how many accounts have or will be compromised. I'm not overly familiar with how the other advanced permissions work, but if they're anything similar to the UTRS and OTRS, then I do think we are exposed by not requiring our advanced permission holders to increase their security measures. If an unauthorized person were able to access the ArbCom wiki or a CU account, I could see some highly confidential information being accessed, where if there were a malicious intent, could ultimately have lasting and real world consequences for individuals. Even an undetected admin account deleting new pages that do not qualify for CSD could take months or even years to detect. I think we were lucky that in this particular situation the compromised accounts were used not in a seemingly "truly malicious way".]
As for my own account security, I have a dedicated Wikipedia email account that uses a unique password and 2FA. My Wikipedia password was previously also unique among my passwords and I have my SHA-1 committed identity listed on my about page. Once the incident occurred, I immediately changed both my passwords, implemented 2FA on my Wikipedia account, and recorded my scratch codes in analog form. I don't think anyone can be entirely confident about their account security. I can only hope that's enough for the time being.