I think you are right swiv3d!
To the best of my knowledge, the purchase password is assigned on an order by order basis and is linked to the email address used for each order. Take a look at:
https://rover.jriver.com/cgi-bin/buy.cgi?productid=83That is the purchase page, but basically the same page is used for an upgrade.
For each order, whether a new purchase or an upgrade, you can assign a different email and password. Then it and/or the Registration Code can be used for future transactions.
About the only time that you actually need your purchase email address
and password used after purchase is if Option 3 on the restore page applies. That is, you need to change your email address for your
current licence, so that a Registration Code can be sent to you, and hence you can do a licence restore. See
https://rover.jriver.com/cgi-bin/restore.cgi and
https://rover.jriver.com/cgi-bin/restore_email.cgi?displaychange=1The only thing someone can do if they knew the email address and password you used during a purchase/upgrade is change the email address associated with your licence, and hence steal your licence. If that were to happen I'm sure JRiver could sort it out.
So the only threat to your security is if you used the same email address and password elsewhere, allowing someone to log into another service you use. The advice after any security breach is to change all passwords everywhere, so if you have done that, there is no longer any need to change the password associated with your JRiver purchase.
Of course swiv3d, we could both be wrong... but I don't think we are.