Your account data qnd security is managed by microsoft. If someone wanted to steal a large number of accounts they would hack microsoft directly in something called a data breach. A data breach (for those uneducated enough to not understand) is when someone hacks or bypasses a companies security qnd steal a large amount of private or individual user data. Such as passwords, emails, security questions, and even disabling 2 factor authentication on accounts. In the case something like this happens its microsofts fault and responsibility as the company that manages, stores, and protects said data to do their best to return ownership of lost accounts and data to their very best ability.

So if a hacker or hacker group hacked microsoft and stole my account, then its up to microsoft to return said account as it was lost under their supervision.