They were able to spoof tokens for a long time, access mailboxes, etc.

If this isn't enough for you, there's also ChaosDB, the cross-account vulnerability Palo Alto found (https://unit42.paloaltonetworks.com/azure-container-instance...), among many others.

This isn't an isolated instance, that's a pattern.