Yeah the credential breaches are whatever, bad security on both the users and 23AndMe's part. The real problem is how accessing a few accounts gave access to many uncompromised accounts' information. That is squarely on 23AndMe and the letter appears to do nothing but deflect responsibility for that.