Safari message "compromised passwords."

Yes, it's a legitimate message. You're using passwords on one or more accounts that have been breached on compromised websites/accounts. It is highly recommended that you do NOT reuse passwords across multiple websites/accounts. Safari and Keychain will manage your logons such that you don't even need to remember your passwords. Other 3rd-party applications such as 1Password also aid in keeping completely unique logon credentials for all of your accounts.

Personally, I just use the Keychain approach. Synchronizing Keychain to iCloud enables all my Macs and Apple mobile devices to have the same access to those credentials.

Please review Password security recommendations - Apple Support. Passwords may be categorized as weak, reused, or leaked.