users knowingly opted into a feature that had a clear privacy risk.

Your aunt who still insists she's part Cherokee is not as capable of understanding data security risks as the IT department of the multi-million dollar that offered the ludicrously stupid feature in the first place.

People use these sites once right? Who's changing their password on a site they don't log into anymore? Given that credential stuffing was inevitable and foreseeable, the feature is obviously a massive risk that shouldn't have been launched.