My point is that the data she is protecting is not just the crossword data, but that it also includes the users' passwords. Protecting that data is always worthwhile, because those passwords are so frequently reused. This is not "security for the sake of security". It doesn't matter if the passwords are protecting the most unimportant thing on the planet, the passwords themselves still need to be protected.