@taglia as @stevelw suggests, the encryption password is completely separate from this issue. That is one more hurdle a bad actor must jump through in order to get your vault data, however they have a lot of useful data before that point.
Here is all the data I can think of that one can see about you from looking at your Obsidian Account on the website or by signing in on the Desktop app.
Stage 0
No Knowledge Of You
< Required to pass to Stage 1: Email; Password; [Suggestion: 2FA] >
Stage 1
Access to Your Obsidian Account Online.
This gives knowledge of your:
- Email
- Full Name
- Last 4 digits of your payment details
- Which licenses you have purchased
- All of your remote vaults
And gives the ability to:
- Delete your account
- Change your password
- Change your email
- Sign into your account on another device and use your licenses.
- Edit your Obsidian Published sites (? Needs verified. I believe it would allow you to replace an existing site with a new one)
- Download your remote repositories. Even without knowing the encryption key, the bad actor now gains the ability to brute force your vault by continually guessing different passwords until they get it right, if they have a powerful computer(s). Depending on your encryption password this could take somewhere between days or decades to guess. Though technology is always improving, and this attack surface should still be protected.
No notification is given when someone logs into your account from a new computer/ip (that I have seen) so the exposed user would be unaware of the issue unless the bad actor did something to reveal themselves.
< Required to pass to Stage 2: Encryption Key(s) >
Stage 2
Access to all the data in your vault(s) 
