If they got more than a pittance per box I'd care more. As is, I'd rather just give them a donation of 3-4 bucks and call it a day, then buy the store brand or make my own.
Given that the most successful data thieves use social manipulation, I'm not sure how big a deal this really is. Doesn't matter how secure your password *would* be if you told it to someone, or if a person somehow convinced an operator to email the reset info to their email instead of yours.