My bet is that you could write all of your passwords on your front door and still not be victimized in any meaningful way. But, in many/most cases, it's cheaper to thwart the attack than to analyze if it can be used to exploit your systems.