And there's a difference between "ban everyone reporting outside their city" and "flag unusual behavior and trigger additional protections or checks". Think how your credit card works when you suddenly make a purchase in Las Vegas.

And in my cited example, the logins were reported as malicious to Microsoft, their account panel said the account had been "secured" since then... but Microsoft apparently let an Android phone the attackers linked up in Nigeria remain connected to the account, giving them persistence past password resets.