I get where you're coming from, but to be perfectly frank about it, most companies don't grant access to executives which would allow a breach if phished. Executives should never have access to servers, databases, etc. All of that should be under lock and key, with multiple failsafes, checks and balances, and procedures in place to safeguard users' data. All things considered, it wasn't the end users' faults their data was breached, it was Yahoo's. Even if an executive was phished, and that's to blame for the breach (which I haven't researched so I'm just taking your word on it). Gaining access to a corporate network should never also grant access to sensitive customer information. A lot of executives' egos get in the way of security, but at the end of the day they should not have any more access than the average employee.
I totally agree that a lot of companies don't take it seriously. I've seen it first hand. I'm not a security expert but I often work very closely with them (and somehow found myself involved in 5+ last year) as my realm of expertise is all-encompassing. Most companies are only concerned with self preservation when it comes to breaches. Even the security companies who specialize in mitigation of existing breaches, when it comes down to it, do not care about the users or their information. They really only care about the $20k+ invoice they send to get started, and the subsequent ~$30k+ invoices they send every week thereafter.
Anyway, coming back to the topic at hand, multifactor authentication is something every single company should be doing right now. It's one of the easiest methods to prevent human error/oversight, and multiple layers of service/website errors/oversights (pretty much every OSI layer), from resulting in a super easy breach. Even watching someone enter their password, with multifactor authentication, does not grant a person access. That's both incredibly simple in nature, and incredibly powerful in practice. Again, not infallible, but a very good step in the right direction.
The days of "don't tell someone your password" are gone. To think that the people out there with malicious intent are that incapable, incompetent, and unmotivated is a dire mistake. The industry has underestimated those people in the past, with extreme consequences. In 2018, it's probably about time we all admit that there are very intelligent people out there with the means, capability, knowledge, and motivation to steal information.
Any security measures we can take are only a deterrent. At the end of the day, security measures are like an ADT sign on your lawn. If a person wants to break in, they will. However, the sign is very likely to cause them to go somewhere that doesn't have a sign. Most of the time, you just need to bring yourself out of the "low hanging fruit" category. However, at the end of the day, security is inherently a step behind the people with malicious intent. It has to be, by nature. Security is simply employing counter-measures for known threats.
EDIT:
Sorry for the long winded rant. I really like this sort of topic :D
