Which isn’t to say it doesn’t happen. I still occasionally get my password emailed back to me from small handbuilt websites. Which is part of why you should at the very least never use the same password twice.