In QAbstractItemModel reset signal documentation, role names are mentioned as a one of things that are invalidated and which should be re-queried by a model user. Qml is is not respecting that, and roles names are set only once after a first data chunk is read. As a model is free to redefine and re-use roles ids that situation may cause a security issues.

Component {
 id: delegate
 Text {
   text: userName // after reset it may show userPass instead
 }
}