...regardless of the financial damage they may or may not do.
From what I remember from another article on here, most of the time it is the banks/etc that are liable when someone is the victim of identity fraud, not the victim (like a 50$ maximum liability or something). The banks don't give a crap about keeping your money safe, it's about keeping their money safe.
>> someone who obtains your password will use it immediately, not sit on it for weeks until you have a chance to change it
True, but I've personally seen several cases where someone's email or facebook account was being used for unsolicited advertising and pornography, and they didn't even know it. They may use your password immediately, but they may also use it for a long time before the average person realizes it.
Furthermore, their conclusion was justified purely by economic motives - about how much financial damage is done by cyberattacks, versus time spent changing passwords. There's no mention of the obvious privacy concern when a spammer has your password - regardless of the financial damage they may or may not do.