Auth0 isn't a password manager. It's an authorization platform. If they stole Auth0 API secret keys and/or saved logins to the Auth0 management portal, they'd have access to other users' accounts but not passwords.