There's essentially no real harm done. Many of the primary account holders are sharing their accounts regardless. It only becomes a problem when idiots start messing with people Amazon orders, eBay, PayPal, etc. But even all that stuff is insured by the company or banks. So in the end it's only hurting the company.
So you think this is okay then?
You think it's okay the company's aren't doing a better job? There's pros and cons. Peoples accounts that have been comprised will better educate themselves on security. Also company's will take security more seriously. I never said it was okay.