Having no password doesn't mean it can't be hacked. Maybe Notion won't end up in a haveibeenpwned email, but that only addresses half of a single one out of three of my objections to web applications.