This is still bad since they now will have a list of possible usernames on the system but not nearly as bad as getting access to the hashed passwords as well.
edit: damnit nknighthb, beat me to the punch! I'll add that privilege escalation attacks on Linux are common place and it won't be difficult to get root once they can execute arbitrary code. Installing a rootkit/backdoor is the typical first step once you get inside a box; if you can't get root immediately you can either brute-force a root login or sit and wait for a new 0day to pop up (which is probably every quarter for Linux systems).
Of the 50 distinct kernel exploits announced this year, the following are ones which either give privilege escalation or expose memory of the kernel: CVE-2014-0038, CVE-2014-0049, CVE-2014-2523, CVE-2014-0100, CVE-2014-0131, CVE-2014-0077, CVE-2013-1860, CVE-2014-2851, CVE-2013-6383, CVE-2014-0196, CVE-2014-3153, CVE-2014-4027, CVE-2014-4014, CVE-2014-0206, CVE-2014-4699, CVE-2014-4943, CVE-2014-4652 through 4656, CVE-2014-3534, CVE-2014-0205
The most important thing you can do for security is to decrease your attack surface, and one of the most effective ways to do that is to not run shit you don't need. Code that isn't there can't be exploited.