If mailboxes of some people were breached, those reset emails can be used to steal their Instagram accounts. So it can be some other breach being exploited, rather than a vulnerability in Instagram account itself.
Password reset emails usually contain a token that expires rather quickly so unless I’m missing something, this should be a non-issue.
And that would also apply to everything. What else? Banks.
It wouldn't be reported as an Instagram breach, in that case.
If my mailbox is breached, Instagram will be the least of my worries.