Biggest problem is the API keys that were potentially/allegedly visible to a third-party or leaked. Depending on how far that goes back, if you don't have cold log storage you might not be aware of which exact keys are out there.

in my personal opinion, 64 character passwords are overkill, and i absolutely refuse to put a password manager on a cellphone. That's just asking for trouble should i ever have my phone confiscated for any reason.

I use a private matrix server to send passwords from my laptop/desktop password managers to myself in E2EE channels, then delete the message. On occasion, if a password is only 18 or 20 characters (like an admin account or a single user service account) i'll type it by hand. And i use all lowercase "easy to say" passwords whenever possible. I do not believe (and never have) that adding an ampersand and a 7 to a password makes it more secure than adding "rb" to the end of a password.