Just to update this, the problem is NOT Duo Security but rather a problem with Cloudflare. I still don’t know how those files were updated so I’ll have to look into that.
Yes I posted a thread already. It doesn’t seem like the plugin is the problem according to my web host. I am curious how the plugin files were updated, didn’t think plugins could do that.