Both, plus people reuse passwords for random websites that might be malignant, plus they share them through social attacks, plus they put them in Post-its, plus

Both, plus people reuse passwords for random websites that might be malignant, plus they share them through social attacks, plus they put them in Post-its, plus they use easily guessable or brute-forceable passwords…