Turns out it's not such a mysterious password after all; checking further, it appears in the password lists I downloaded.
Alright, that's slightly less worrying then.
I was expecting something along the lines of "l0ve1s4lly0un33d" or a 1337 version of "Hey Jude" which would have implied a far vaster lookup table. (assuming it isn't already. well, probably now it will be.)
I can think of one method to vastly reduce the amount of storage required for a stealer-bot, and I'm sure that people much smarter than I am have come up with a similar idea. So it's not impossible for a setup to be able to include a wide variety of permutations, in the hope of catching something in the future. I'm using a modest 2TB array on my temporary cracking machine and I estimate that could store around 20 to 25 billion candidate addresses.
I had a quick look through the results, and my system has found at least one 8 character password that does not appear in any of the source input files, has zero Google results, and is not on haveibeenpwned. The password evolved by mixing two or more disparate source lines together, and applying some extra mangling (appending, truncating, etc). THAT'S what should scare people off using sha256 wallets: your cool 8 or 10 character "random" password, even one that has no words in it, is not unbreakable.