> That a top-level security expert would have left all his own passwords exposed was transparently ludicrous

Not quite. Some experts apply all their own expertise to themselves, others are more lackluster about their own opsec because they 'know what they are doing' or 'this isn't anything important'. Never underestimate human laziness.

I work in IT security and I see the full range of total disinterest to full tinfoil hat mode in this environment when it comes to people's own resources.

Also, it depends on people's area of expertise. Most of our networking security specialists are running segmented VLANs and IDS at home, and WPA3 with all the trimmings. The Windows AD security guys would just have whatever router the provider provides and sometimes don't even change the provided wifi password (which in many cases is algorithm-generated based on the MAC address or something!), but their windows workstations would be top-notch secured.