While @gowenfawr hits the main points, I have a few to add:
Most systems, but not all, hide the actual passwords in
/etc/shadow. To see if your system is vulnerable, check a real user account. If it looks like
Then your passwords are safe.
If it looks like
Then your passwords are NOT safe.
Yes, the password is obfuscated using a one-way hash function, but that is not enough. Having this file allows the hacker to check if a given user has a certain password without actually trying to log in.
In 1970, this check was slow, and things were reasonably safe. Today, a hacker can check millions of passwords per second. If one of your users has a guessable password, that user's account will be hacked. And the limit for what is "guessable" is pushed with every processor generation.
Now you have checked, and found that your passwords are safely stored in
/etc/shadow. Good, problem solved.
/etc/passwd contains more information.
It contains the full name of every user. This is very useful for social engineering attacks.
It contains a list of system users, which indicates what software is installed.
So, I get an email going "Hey Stig, I have forgotten the postgres password. Could you remind me? Signed, Other Real User". Since my helpful email client doesn't show the full email address I will not notice that this email comes from a remote country. I reply, "It is 'S3CR37'". Oops, the company database just got hacked.
Of course, this is not the only way full names get exposed, you need to teach the users about social engineering attacks anyway.