It's also a bit of a privacy risk to the users - if they use a publicly-known username (email address) with a very low-security password (e.g. 'password') across multiple sites, someone else could log in as them and e.g. track their activity on these sites.
People create weak passwords for services which shouldn't be authenticated in the first place.
If you're throwing up a registration requirement just to read public content (say, as the BBC seem to have begun doing in the past month or so), then yes, a large number of people will offer a bogus userID and the password "password", or a semantic equivalent.
(If they bother using the service at all.)
Overauthentication is itself a manifest security problem, because you're now effectively requiring bad keys be used.
See also: Twitter, Quora, and any number of other regwalled services. (I simply avoid using them.)
That said: organisations should reject any of some reasonably large number of well-known passwords. Where large should be well into the thousands if not millions by frequency of noted use.