There should be an exemption from the Captcha for users with strong passwords. And if this spreads maybe we can just annoy everyone into good security practices.

Strong password is still bad if you reuse it on a website with a leaked DB.

That's what I don't get. What value is there in such an account? The fear that random persons can watch videos without paying until the owner notices they can't stream because someone else is using the account? Are these accounts held for ransom because the owner doesn't want to lose their watchlist? Can you purchase gift subscriptions using the stored payment method perhaps?

It's a nuisance obviously, but for such a tiny fraction of people, honestly not bad if they notice that they got phished or use a password guessable within a handful of tries.

I think they are resold on darknet or something.

Sure, but my question was to what end, what damage is actually occurring