I don't buy your second point. Your argument is that an attacker can try the password elsewhere faster, when the list of sites an attacker is interested in is s

I don't buy your second point. Your argument is that an attacker can try the password elsewhere faster, when the list of sites an attacker is interested in is small. An attacker could try every site in the Alexa 1m before anyone knows the sites passwords were dumped anyways.