I think of it more as "no username, only password". Realistically, usernames are not expected to be secure or private, so this is effectively the same.

There are lots of possible account numbers, much more than there are accounts. So there is a very small chance that you will guess an active paid account.

And if you do, there's not much you can get out of it. There's no personal information tied to the account.