Haven't looked much into the breach, but probably the biggest issue is passwords. If unencrypted, and a user uses the same generic password for their email or bank or whatever, that possess a serious concern.
This highlights the importance of not reusing passwords
Edit: looks like passwords were hashed with bcrypt, which is really quite excellent. Very unlikely anybody is getting actual passwords from this leak.
I think that's exactly their point. Why would Valve tell users to "upgrade" to a more recent version of Windows? Tell them to upgrade to Linux