Not sure when they added it but immediately after seeing this post I hit my account to change my password and confirmed Mint does offer 2FA using auth apps (I used Google Authenticator) so I activated it.
I expect this to replace the SMS codes they'd been sending me before and hopefully prevent what you're describing.
Would be nice if these big firms would stop serving us the breach du jour.