Feedme plugin - importing users into craft commerce

Users will be imported without passwords. Would this provide some kind of security risk, for example, someone being able to log in with empty password?

I don't think the imported users will be able to login at all without a password.

Setting new passwords for users - would I need to write custom module to send password reset form to each imported user? Would not sending 5000 emails at once choke Craft - maybe I should use tasks for that?

I handled this by setting a message on the login and forgot password pages, skipping the need to send an email. Something like "Our systems were upgraded on 10-20-2020, if you've not logged in since then you'll need to reset your password first".

Addresses - do i need to write some custom plugin for importing adddress data along with basic user data like email? I didnt saw any fields for setting up user address when i tested importing users using feedme. Did someone managed to tackle this issue in the past?

Yes, you will need to use a custom module/plugin and listen to feedme events and handle address import with your code.

Something like:

 Event::on(Process::class, Process::EVENT_STEP_AFTER_ELEMENT_SAVE, function (FeedProcessEvent $event) {
   /// your code here dealing with $event->feedData;         
});