In the increasingly service- and account-based Internet, every piece of personally identifiable information a person hands over to a service should be treated as a potential attack vector for phishing or hacking attempts, (not to mention doxxing), not just for that specific service but for any other service the user might have registered for. As such, it is (or should be) of paramount importance for service providers to keep all personally identifiable information completely secure as much as possible. Two pieces of obscured information like username and billing address might not be enough to quickly login as that person through the login page, but if the user uses any of the same information on another service, hackers only need to gather a few pieces of information like that to try to get through security questions or to social engineer their way into the account, which might in turn yield the clues to gain access to even more accounts, etc.
It's overly simplistic to only list the specific fields that were leaked and decide that nothing useful can be done on the Steam storefront with them. It would have been trivial during the breach for someone well versed in web scraping to write a script that repeatedly hit the account details page and saved all the information it could about however many users were getting exposed. All of those represent potential attack vectors. If those users have been the victim of other data breaches for other sites (you may have noticed this is happening with disturbing frequency), their email addresses might already be in hackers' repositories of breached users, and so the info from their steam page can be added into whatever is already known about them. Their billing address or last 4 CC digits or phone number might used as security questions by another service provider, and that would be enough to get in. This is how modern identity theft works.
None of this is certain to happen to any particular user, of course, but I hope it explains why service providers need to be held accountable for any sort of data breach and treat any breach as a massive liability concern, and why users should be encouraged to be safeguard their own information carefully and treat any data breach as a potentially legally actionable cause.
