It substantially limits their movement, as it increases the caution needed to enter any country with which the US has an extradition treaty.

As to explaining password security, the Justice Department is a law enforcement agency, not a security agency.

North Koreans aren't known for their international travel.

North Korean hackers actually travel abroad to their target country for 2 years according to the business insider article someone liked to in this thread. Seems possible they may travel again.

I suppose it's a way of substantiating the attribution of the crime to North Korea. When it was just someone making the allegation, they could've been doing it for any number of reasons, but now it seems the evidence has held up to some kind of scrutiny under due process.