hm? We let users set their own passwords because users are unable to remember secure passwords, which would create a lot of work for people running the service

hm? We let users set their own passwords because users are unable to remember secure passwords, which would create a lot of work for people running the service (and the user as well), even vulnerabilities because we'd be habituated to recovering lost passwords. When the user can set their password they will set an insecure one that they can remember, eliminating most of the password reset work. Then when the user is compromised it's their fault. This compromise works because most users aren't particularly vulnerable-- no one is trying, or no one cares if they are compromised. Why don't we just rely on the recovery security? well Mozilla's persona thing pretty much did.