The compromise I use is to break the cycle: Use a password manager to generate strong passwords (and different ones, because breaches happen), and use a hardware token-based password for the manager itself. At least that's the compromise I'm comfortable with.