Of course, but still there are still some users who are lazy and ignore better security suggestions. I don't know how many users have enabled 2FA on their forum accounts as far as the security feature it provides, but I'm still pretty sure there are a lot of users ignoring it.

Using the same password on multiple sites is definitely a very weak security measure. Some of them may even save that password in the browser to make it easier to log in to the site, but they don't know what the risks are. It might be OK if they don't store anything there, but that's not a recommended security measure.