"The number, the FBI would later confirm, belonged to the genuine Apple Card support line. It had been spoofed so precisely that the messages accompanying the call arrived in the same gray bubbles, with the same Apple logo, that only real Apple support uses in iMessage."
The terms ("belonged to the genuine" and "only real Apple support uses" ) and "spoofed" are mutually exclusive.
Honestly this article could do a lot better job explaining which action he took caused which problem. Because taking this at face value, it implies literally any text you ever reply to, or any phone call you pick up, puts you in danger of your Apple ID instantly being compromised, and along with it, your SSN. The fact that any of this had anything to do with any supposed fraud alert seems coincidental, and I'm left wondering if the fraudsters could've done the exact same stuff w/o ever calling or texting. I think an important part of the interaction during the texts and phone calls is actually omitted here, perhaps at the request of Apple's lawyers as it could involve a vector they don't want to become known. 
Edit history
= new reply since forum marked as read