It's true that this hack was in 2012, but the information lost is not only passwords but also account information like name, addresses, other linked email addresses, etc. So those who changed their passwords after this hack still have something to worry about.

True, but if you've got any internet presence at all, it's already pretty straightforward to associate your name and email address (or addresses). Tools like Datanyze, Spokeo, SellHack, etc. do that routinely. Having 120 million Yahoo records available for mischief (without current passwords) makes things slightly worse, but not much.