Thanks for bringing this to the community's attention @coderanger. I feel like this is fine as long as they give me an easy way to opt-out if I don't want data collected or am using chef tools in a environment that doesn't allow for such collection.
I think that depends on your password management policies. If you are using a unique password for every site, change them all now and then change the ones that were vulnerable again after they are patched. If you are like many people and reuse passwords, you should not change that password to be one you use at a patched site.