This argument is the same as saying "It's not my fault you're being spied on because you're not using OTR in your IM; it's yours." You're technically right that the user could theoretically avoid this problem, but you're wrong in practice since you're setting impossible expectations that even security-conscious people often don't meet.
It's a service provider's responsibility to not let user credentials be easily accessible because those credentials are used in many places. The latter is a more fundamental issue, yes, but you deserve the flak you get if you just say "not my problem."
> 99% of users who aren't IT or security professionals would just prefer to be done with entering their password after the first time, period.
Which is just as possible with tokens as it is with passwords. There is no reason not to use tokens.
I'd never say this at a job interview but I'll be Devil's advocate: As a business, this isn't my problem, it's yours. If you want the convenience of the same password for multiple sites, in the real world there are going to be weak points on some of those sites and someone who can abuse any point of the chain on any site can obtain your password for all.
For the rest, expecting to change my passwords if my phone is stolen is not an unreasonable thing at all. I should do this anyway, even if businesses ensure me that I don't have to.
And 99% of users who aren't IT or security professionals would just prefer to be done with entering their password after the first time, period.