For random password dumps going through thousands of accounts it’s probably fine, but if you’re targeted for some reason and they get just a couple passwords. With even just 2 passwords, that system may be obvious already to someone looking to gain access to your accounts specifically.