ico-services, I have no doubt that some things are not right when it comes to this service, because too many weird hacking cases have happened over the years to blame only the users for everything. If you set 2FA as additional protection, and that protection as we see doesn't work, then we need to ask ourselves what exactly is that protection for - maybe it provides a false sense of security for users?
I think you have presented your case quite well, but I am not sure what legal position you are in as far as their threat is concerned, because they are obviously very bothered by what you have written. Personally, I don’t remember ever seeing them threaten anyone with a lawsuit, and there are hundreds of accusations against them here on the forum.
If you haven't already, I suggest you take a look at this board ->
Web Wallets, and if you use the search option in that board you will find a lot of similar cases like yours. This
one is particularly interesting, it would be interesting to find out what happened in connection with the lawsuit that was announced.