I'm assuming no such thing. I am also not assuming that Alice is responsible for protecting the entire internet.
Your response is exactly in line with my comment - security for the sake of security and unfortunately the analogy of crossword puzzles does not break down there.
Assuming that Alice is responsible to protect her user's data - and there is a comparison with Facebook, Google, and other companies which sell user data, here - Alice's responsibility is to take reasonable steps based upon the nature of the data she is protecting.
Until I started pointing this out on HN, my HN password was "hackernews" because there is nothing here that I really care about protecting, and in my opinion, nothing worth PG implementing complex password protection over.
My point is that the data she is protecting is not just the crossword data, but that it also includes the users' passwords. Protecting that data is always worthwhile, because those passwords are so frequently reused. This is not "security for the sake of security". It doesn't matter if the passwords are protecting the most unimportant thing on the planet, the passwords themselves still need to be protected.
Best password practices do not have to be user hostile. You can still allow a password reset while doing things properly. Yes, you can't e-mail them their old password, but you can set a new one for them, which is nearly as usable.