They leak data but their threat model involves that the attacker can get this leaked data too (they leak it to the hard disk?). >provide enough passwords Why

They leak data but their threat model involves that the attacker can get this leaked data too (they leak it to the hard disk?). >provide enough passwords Why don't they just store some dummy users' (with zero privileges) credentials directly on the hard drive? They simply can provide valid passwords from it after reboot and your attacker can have these passwords since they can't do anything with them. Maybe their leak strategy involves something like this?