What must I do if my Apple ID gets compromised?

In a scenario where you suspect that your Apple ID is compromised or have been hacked, it is best to assume you have. Although the email you got could have been spam, there is a chance that it's not as mentioned by other users. The first step as you mentioned is reset your password and then enable 2FA. A couple other steps you could take in addition to what you have provided:

• Check Safari history as sometimes hackers will alter bookmarks and autofill in search. This is only possible if you use the safari sync option.
  
• When you enable 2FA make sure you don't use SMS. (https://www.cnet.com/how-to/do-you-use-sms-for-two-factor-authentication-heres-why-you-shouldnt/)
  

Finally, if your account has been hacked, is it worth asking how it was hacked? Although there is the possibility of a brute force attack, that is much less likely because you used a randomly generated password. Here are some ways the attacker could have gotten your credentials:

• Phishing scam through email or fake link online
• Compromised software on computer or phone containing keylogger
• Using a public wifi in which your data was compromised
• Not keeping software up to date which could potentially have vulnerabilities
• Having autofill on if you use a password manager could leak data to hackers (https://thehackernews.com/2017/01/browser-autofill-phishing.html)

This is just touching the tip of the iceberg but hope this helps and best of luck with securing your account.