I think that's evidence that we just haven't done a good job when it comes to accounts and account security. Users choose simple passwords and reuse passwords because otherwise they need to remember a different complex password for every single goddamned thing they interact with, a number that has skyrocketed in the past decade or two.

I can't honestly say I know of a better way, though. Something involving identification using asymmetric keys would be a good start to replace username/password, but that doesn't really solve the problem of losing or compromised private key in a way that's any better than we have currently for passwords.