This sounds like they were using the "tap a button on your device" 2FA method (see https://support.google.com/accounts/answer/7026266). Not sure of the details as to how they got to that page in the first place, though the docs say that you can potentially use it to recover your account.

Never trust an incoming call, especially if it's talking about authentication problems you didn't know you had.

Googler, opinions my own (and I'm not an expert in this particular space).