Apple's new security measures protect users only in a few situations: app and music purchases, managing an Apple ID account or receiving customer support related to Apple ID. It does nothing to protect other important information, like photos and other files stored on its iCloud service.
A hacker who manages to figure out a user's Apple ID and password could log into that user's iCloud account, and download all of the potentially sensitive information stored there -- even if that user has the two-factor system enabled.
Apple never said its two-factor system would protect iCloud but users assume that implementing two-factor authentication has them covered across the board.
Apple needs to be highly concerned regarding security of customers.