I think it is unfair for them to be required to email their entire userbase when maybe 0.1% were POSSIBLY affected.

They emailed the people that logged in during that time and anyone that had a shared folder with anyone that logged in during that time. That seems pretty fair to me.