The exposure of cryptographically scrambled passwords isn't a worst-case scenario—but it isn't great, either.