Users passwords were leaked in other breaches. 23andme could have forced everyone to setup new passwords but that is not usual practice, is it?

The hackers broke into this first set of victims by brute-forcing accounts with passwords that were known to be associated with the targeted customers, a technique known as credential stuffing. From these 14,000 initial victims, however, the hackers were able to then access the personal data of the other 6.9 million million victims because they had opted-in to 23andMe’s DNA Relatives feature.

From the description it sounds like they have a point. If people reuse their passwords and then get hacked, the hackers are going to have access to their full accounts, including any information shared with them.

How is this different than if hackers reused passwords and hacked into Facebook accounts and then saw the user’s friends’ profiles?

This is like if a robber got in through a hole in the wall, and the architect blamed the homeowner for having a spare key under the mat. Sure, it’s not a good security practice, but that’s not the issue here.