Seems like there is more context on this that this article misses: https://www.pcgamer.com/software/security/no-16-billion-pass...

This is the natural consequence of what happens when you fail to enforce security liability on device manufacturers. Two+ decades of insecure IOT devices network connected that enable this type of collection, and other bad bad things.

Plaintext or hashes?

According to the original source (linked in the article), the credentials are plaintext from infostealing malware, not centralized breaches.