This title is incorrect. Credentials not stolen, usernames and hashed passwords stolen. That is not the same as having everyone's password. The title implies someone can easily log in to your account.
It is for everyone who used "weebly" or any of the top 100 most common passwords.
That could mean no less than 82% of users are at risk.
[1] me
as for brute force, yes attackers now know usernames, so can try brute forcing the live sites, or brute forcing each user hash.
Strong brute-force protection (eg block account for exponential times) could mitigate this attack vector.
The attackers have the salts and the hashes, they can brute force the hashes offline with [ocl]hashcat as they wish.
Top 100 passwords * 43M accounts is only ~4B hashes to compute. We don't know what bcrypt parameters they used but we're probably talking a few hours here, maybe only a few minutes.
you are right that it's now very easy to use dictionary attacks now, on all the credentials offline. and those with super weak passwords will have their accounts compromised.