According to a note at the end of section 2.2 of the TLS 1.3 spec (RFC 8446),
When using an out-of-band provisioned pre-shared secret, a critical consideration is using sufficient entropy during the key generation, as discussed in [RFC4086]. Deriving a shared secret from a password or other low-entropy sources is not secure. A low-entropy secret, or password, is subject to dictionary attacks based on the PSK binder. The specified PSK authentication is not a strong password-based authenticated key exchange even when used with Diffie-Hellman key establishment. Specifically, it does not prevent an attacker that can observe the handshake from performing a brute-force attack on the password/pre-shared key.
Is the vulnerability of concern here that observing a handshake would allow an attacker to brute force the shared secret offline based on the PSK binder?
And, if an attacker could recover the shared secret, is confidentiality of the previously-observed TLS-PSK stream compromised? Or would this only allow the attacker to compromise future streams (e.g. by spoofing the server and/or client as a man-in-the-middle?)