Right, so I should be ok about a company that recently lost 7 million passwords that were 'encrypted' using only SHA1, suddenly getting access to a whole raft more passwords?

Access to this many passwords is a threat even if my password is not one of them.

Finally, it may be opt in, but are they going to explain to the user that they get to keep a password for an account to which they have no legitimate right?