So, to take it to one extreme, you think that if zero accounts were accessed, then it would be reasonable for zero users to be directly notified about this?
That doesn't sound reasonable in the least bit.
That doesn't sound reasonable in the least bit.