They were. OP seems to have bought into the fake story that someone legitimately hacked iCloud and only made it out with photographs.

Root and empty password was a macOS issue: https://twitter.com/lemiorhan/status/935578694541770752