[mothered]

How can a rootkit on the server of fucking ACER go unnoticed for nearly an ENTIRE YEAR?

Exactly this.

The report on this Is current, yet brought to the attention of the general public a year later. In terms of the possibility of passwords being compromised, It should be safe to assume that they're stored In an encrypted form and obviously not plain text. Judging by Acer's security (or lack of), they'd probably be silly enough to store the decryption keys on the same server.