So not true. Browser and OS vendors recognize this problem. “Store this key securely and provide it to me” makes sense to implement, so websites can take advantage of all the hardening and security features of the device versus hoping someone doesn’t share a password between two sites.