Simple--you work towards making password compromises less fruitful. MFA is a step in this direction, and done right, it should be able to alert admins and user

Simple--you work towards making password compromises less fruitful. MFA is a step in this direction, and done right, it should be able to alert admins and users alike that compromise and stuffing is in- progress. Password managers and generators can make unique passwords easy as pie, thereby reducing the rampant reuse, and unwillingness to reset passwords when necessary. Magic links and passkeys can make passwords obsolete. CAPTCHAs interfere with automated stuffing operations. The largest services are also developing sophisticated measures of device fingerprinting and trust, of which attestation is the endgame. Y'all don't enjoy credential stuffing or data breaches, but love rooting and rail against attestation, so do you want to have your cake and eat it too?