Generally, at least in somewhat decently set up systems, attacker has no way to know if the password was 4 or 40 characters long. Also, in general, attacker can't just try every possible password, as it would just take too long. With short passwords (and limited set of characters) it's possible, but with tens of characters it's just not going to happen.

Additionally, if the system is built even half competently, passwords are stored in a database in hashes and with a salt, so if your password is 'hunter2' the value in database would be something like 'supersecretsalt+hunter2' (trough hash-function obviously), so you can't just take rainbow tables and compare them directly.

Now, if the attacker has the salt then they can build their own tables with known passwords and see what matches or in some cases they can reverse engineer the salt out of the system and proceed with "normal" approach. Or, depending on the breach, they might have access to the password verification functions and they can just override rate limits and other stuff and brute force accounts locally and then exploit them at the real world.

There's a ton of nuances on this and I'm not an expert by any stretch, but in general if you use sufficiently long passwords (preferably with a password manager) there's no way to brute force your password with current technology. But, since there's 'a few' breached passwords around the net, it means in practise that not all systems are built securely and their vulnerabilities are used to get account information, passwords included. Also malware, phishing and other means are possible when gathering login info.

With a new data breach attackers might just be happy that they can break 20% (or whatever) of the passwords and use them as they see fit and just ignore the rest as it's not really worth the time to try and break them all. And if they are interested in some spesific account then there's other ways, like phishing or social engineering, to build attacks targeted on that spesific individual.

The attacker could brute force it. Or they can make a phishing page to try and get the user to enter in their password.

1. An attacker would get a similar enough looking domain and mimic the target login page using something like EvilNginx
2. The attacker would send a fake email to the victim while looking as legit as possible. Saying something like too many login attempts have been detected, please use this URL to confirm your account, or your password is expiring please use this URL to update it. That sort of thing.
3. The victim would click the URL going to the attackers login page and enter in their details.
4. The attacker now has the valid login credentials.