"These credentials are gathered through credential stuffing attacks where threat actors attempt to login to Zoom using accounts leaked in older data breaches. The successful logins are compiled into lists that are sold to other hackers."

This feels like ridiculous piling on to Zoom. This comes down to the same old password reuse issue. You could almost certainly replace any other service provider with Zoom in that article and not reduce its accuracy. Pounds for pennies, other services have hundreds of thousands of accounts being sold courtesy of credential stuffing.