Hey there! Nice to meet you!
Based on your description, your Microsoft account was compromised. The hacker was able to remove the account's primary email address/security info and replace it with their own email address.
Since you were able to request a security info change, I'm afraid your only option is to wait for the 30-day restriction state to complete; but, since the hacker has their email added to your account, having them in full control over your account, they can simply cancel your security info change request.
If this happens, you will need to try requesting again, and hopefully, the hacker will not notice.
Unfortunately, it is also not possible to bypass the 30-day restriction state.
However, if the 30-day restriction state is complete, you will be able to remove the hacker's security info email using your newly added security info and regain complete control over your account.
Thank you for your kindness and understanding! Please let me know if you need anything else.
Best regards,
Darhyl