Because even I, somebody that cares about all of this a ton, sometimes copy paste passwords out of my password manager because nothing else works. Because temporary read-only backend compromises shouldn't lead to catastrophic and persistent security breaches (because passwords are provided in plaintext inside TLS, and TLS is often terminated at the edge). Because educating people for a complex and moving target like the details of authentication seems like a losing proposition at best, and like victim blaming at worst.

So no, please don't blame people, blame bad authentication mechanisms (including passwords) and those that hang on to them despite better alternatives.

> There is no excuse for using weak passwords anymore.

Weak passwords are only a small part of the problem. You can get phished with even a 256-bit equivalent random string.