I've been hosting with WPE for 3 years and have about 85 sites on there. While this is a huge inconvenience to reset all of these passwords, I have yet to have one client request yet that their SFTP login isn't working. I either maintain the intial WP login user or deleted it long ago and use my own login regardless... and any of my clients that have their own user login to the customer area also received that email.

I say, "well done!" It was worst-case to reset all of those but they also mitigated any danger by doing so. I'm ever-more impressed with how they handle things in a managed setting's expectations.