Unfortunately, that is correct since your account's security info has been modified by the hacker already.
You may try reaching out to Microsoft Support, as they can possibly "Suspend" the account permanently once they have confirmed that the account can no longer be recovered in order to prevent the hacker from using it:
Type "Microsoft 365 sign-in problem" > Click "Get Help" > Scroll down and select the option "Sign in to contact Support" > Microsoft 365 and Office > Billing and Account Profile Questions > Confirm > then select "Chat with a support agent in your web browser"
Best regards,
Darhyl