Your initial report emails will always go to the affected email addresses.

But future breach alerts will be sent to the Primary address. (If you select that in your preferences.)

Ah, OK. I expected that if I add a new address when already having the preference set for sending notices to the main one, they would go to the main one.