There's a reason I put "compromised" in quotes. By that I mean that not all 8 digit numbers are yet flagged in haveibeenpwned.

Of course there's no world in which they're actually a secure password, which is why it's kind of insane to treat them as one.