"security risks found"

When I go to the Passwords list on my phone (I have the "Detect compromised passwords" feature enabled), there's a list of 112 "security risks found" for sites and apps I use. Most of them are under the "high priority" category and it says the password appeared in a data leak, and that I should change the passwords ASAP. When I click each one for more details, nearly every one of them shows "This password was last modified 9/21/20." They're almost all websites rather than apps, some of which haven't used in years. Oh, some of the 112 are not showing as data-leak issues, but they are noted as commonly used by other users, or as reused by me for several sites. Fair enough, I'm glad to take the time to change every one of these passwords if that's warranted.

BUT... when I check Google Chrome's stored password list, it only identifies two sites with compromised passwords. Both sites are also on the list my phone shows.

I searched "haveibeenpwned" for my email address, and it came back with data breaches on five sites that, again, I don't think I've accessed in five or more years. And none of them are on the list from my iPhone.

Who do I believe? "Better safe than sorry" works for me, and I am willing to change them all to protect my financial information and my personal privacy, but why wouldn't my phone and Chrome both find similar issues? And wouldn't I have been notified by email or with a pop-up by most of these companies or organizations themselves if they'd been the victims of a data leak?