That is true in principle and I didn't take that into account when I thought about it. Though it would still be possible, in theory, to use a hash function that is cheap enough so it's feasible to hash all the leaked numbers once, but expensive enough that it would take a long time to brute-force the whole number space.

Since there's about 32 million leaked US numbers, but there potentially exist up to 10 billion, any hash function that would take a day to process the leak would still require over 300 days to bruteforce the whole space.

Granted, any number in the leaked set could still be trivially reversed when submitted -- but those were known already anyway, they are just associated with more metadata now.