Despite the irony, I'm not arguing it should be less of a concern.

Recent mishandling of user accounts by Sony Entertainment and LinkedIn gave us a glimpse of how much damage an intrusion can cause, even though (?) their management thought their intended purpose couldn't lead to any serious liability (speaking through my hat here).