Users use the same passwords everywhere. By cross-referencing user passwords through excessive brute force you could find accounts on other sites that link to a user’s personal data.

Is the password personal data?

You have to draw the line of correlation difficultly somewhere.

I would expect a company to guard customers' passwords every bit as carefully as they guard customers' e-mail addresses, and probably moreso, yes.