They have been hoovered up, by home assistant. I made no claim, nor did the source, that clear-text credentials were shipped anywhere.

This is meant to drive awareness on a transparency and dev issue, not an overt compromise. My language was maybe a bit too inflammatory though, I suppose.