They are sacrificing the security of their customers for business reasons (usability will increase retention). If they get hacked, if/when they send out a disc

They are sacrificing the security of their customers for business reasons (usability will increase retention). If they get hacked, if/when they send out a disclosure they'll just say that personal information may have been leaked. Sure, they've made their case for it, but it's only slightly less disconcerting than if they didn't know what a hash is. Actually, it's probably worse, because at least someone that doesn't know about hashing could be educated - these guys have shown that they put profit above protecting their customers.