Since the majority of people still have the security setup of "one or two emails for most of the things and a set of 2-3 close passwords"
The moment you have a leak of 200 000 000 email password pairs the whole industry is in trouble not only the site that leaked them.
Currently there is semi random brute forcing - just taking already cracked lists and mutating them to guess the password.
Best password practices do not have to be user hostile. You can still allow a password reset while doing things properly. Yes, you can't e-mail them their old password, but you can set a new one for them, which is nearly as usable.
Your response is exactly in line with my comment - security for the sake of security and unfortunately the analogy of crossword puzzles does not break down there.
Assuming that Alice is responsible to protect her user's data - and there is a comparison with Facebook, Google, and other companies which sell user data, here - Alice's responsibility is to take reasonable steps based upon the nature of the data she is protecting.
Until I started pointing this out on HN, my HN password was "hackernews" because there is nothing here that I really care about protecting, and in my opinion, nothing worth PG implementing complex password protection over.
The only cryptologic issue I take is that to some degree the analogy illustrates [rather than breaking down] the security for security's sake commonly argued in regard to passwords.
Imagine Alice decides to found a crossword puzzle startup. Password recovery is far more important than protecting passwords. The answer for 2A is not important enough to justify a computationally intensive salt and hash. She is responsible for entertaining customers, not running a bank.