Even with those assumptions (which I question), it is only a higher level of security if you assume that your users are reusing passwords, or using low entropy

Even with those assumptions (which I question), it is only a higher level of security if you assume that your users are reusing passwords, or using low entropy passwords. Neither would apply if they are using a password manager, which a growing majority of web users are.