Feedme plugin - importing users into craft commerce
Users will be imported without passwords. Would this provide some kind of security risk, for example, someone being able to log in with empty password?

I don't think the imported users will be able to login at all without a password.

Setting new passwords for users - would I need to write custom module to send password reset form to each imported user? Would not sending 5000 emails at once choke Craft - maybe I should use tasks for that?

I handled this by setting a message on the login and forgot password pages, skipping the need to send an email. Something like &quot;Our systems were upgraded on 10-20-2020, if you've not logged in since then you'll need to reset your password first&quot;.

Addresses - do i need to write some custom plugin for importing adddress data along with basic user data like email? I didnt saw any fields for setting up user address when i tested importing users using feedme. Did someone managed to tackle this issue in the past?

Yes, you will need to use a custom module/plugin and listen to feedme events and handle address import with your code.
Something like:
 Event::on(Process::class, Process::EVENT_STEP_AFTER_ELEMENT_SAVE, function (FeedProcessEvent $event) {
   /// your code here dealing with $event-&gt;feedData;         
});