So for as far as I understand it:

Yes, this is a big issue on the developers part as this should not have happened without consent.

No, this is not a direct security breach for every and all home assistant users. You do not need to immediately change all your passwords (due to it being partial hashes)

Did I understand correctly? I’m not that deep into how all this works as I am mostly a enthusiast user without a lot of computer science knowledge