You're assuming that an extra step always implies a usability penalty, but that's not true. "Usability can be described as the capacity of a system to provide

You're assuming that an extra step always implies a usability penalty, but that's not true. "Usability can be described as the capacity of a system to provide a condition for its users to perform the tasks safely, effectively, and efficiently while enjoying the experience." (https://en.wikipedia.org/wiki/Usability https://en.wikipedia.org/wiki/Usability) Notice the presence of "safely" there. You should be penalizing the alternative in each of these examples for the non-zero risk of data breaches and getting pwned. Then we can have a more productive debate about which cost is greater.