My point is that the data she is protecting is not just the crossword data, but that it also includes the users' passwords. Protecting that data is always worthwhile, because those passwords are so frequently reused. This is not "security for the sake of security". It doesn't matter if the passwords are protecting the most unimportant thing on the planet, the passwords themselves still need to be protected.
Your response is exactly in line with my comment - security for the sake of security and unfortunately the analogy of crossword puzzles does not break down there.
Assuming that Alice is responsible to protect her user's data - and there is a comparison with Facebook, Google, and other companies which sell user data, here - Alice's responsibility is to take reasonable steps based upon the nature of the data she is protecting.
Until I started pointing this out on HN, my HN password was "hackernews" because there is nothing here that I really care about protecting, and in my opinion, nothing worth PG implementing complex password protection over.