So the question then becomes, which one is a bigger risk, forgotten passwords or malware.

And the second question then becomes, who is the right person, the user or the developer, to answer the first question.