It's patched now, but for a few weeks, hackers could VPN close to where your account was made and trick Instagram's support AI into giving them the keys.
Once it looks like the request is coming from the correct region, they tell the Meta support AI that the account is hacked and ask it to send the verification codes to an arbitrary email address they control.