Everybody sucks at memorizing unique passwords. I'd be stunned if homeless people are consistently not reusing passwords. Credential stuffing is the #1 form of account takeover and 2FA is the solution.