If a sites database is hacked then you can assume their entire site is compromised, in which case whether or not they find out your password is moot because if you use real security and every site has a unique password you risk nothing if they do crack it. If you use the same password for every site cracking is the least of your worries, what if a website is breached and the login system is replaced with a system that stores your password? What if you're phished? What if your computer is stolen and someone just checks your saved passwords? No matter how complex a password is if it's used on multiple websites it's insecure.
However, I am in the small minority and we have to face the fact that most people use one or only a handful of passwords, and these people have a very poor idea of the criteria for a good password, mainly because so many sites have poor guidelines, and poor policies (like max 16 chars, no punctuation, etc).
As for your other point, using a password manager is good, but not always practical. I have an algorithm I use so that I know all of my passwords, but they are different.
Sites that require you to have a number in it, or a capital letter, or something like that are doing the wrong thing and promoting poor passwords. People think "if I add a number on the end its far more secure" when it isn't. This provides a far more accurate measure so that sites can enforce a minimum complexity which promotes good passwords.