I agree that this is a bad scheme, but I think the hash rounds do serve a purpose, which is to protect from sites with no/weak hashing. If a list of passwords g

I agree that this is a bad scheme, but I think the hash rounds do serve a purpose, which is to protect from sites with no/weak hashing. If a list of passwords gets leaked, it will be intractable to derive your secret from your password. But it gives you no good way to rotate an individual password if it gets leaked, and no good way to systematically rotate the secret if that gets leaked, since you’ll have to remember every site you used it on. Contrast that with a password manager, where rotating a single password is trivial, and rotating your entire vault is painful but straightforward.