I had to deploy a new VCSA, add the two "broken" hosts in the new VCSA, add the vSAN service to the vmks and then remove them from this VCSA. I couldn't find another way to do it but it would be nice to know for the future 🙂