Skimming a couple of the sources mentioned in the article and the linked german government Q&A it seems they scanned a) collaborators and b) "potentially dangerous" afghan citizens.

So we can reasonably assume that biometric data of those two population groups was leaked by left behind devices. Not the entire population, but the two most sensitive groups. Sounds pretty bad imo.