A full hack of every part of the service is not the only way a user’s password could get known to an attacker. Could be MiTM, could be typo-squatted, etc

If a site is that compromised no measure of auth is gonna help, so little use worrying about it.