But there's zero reason for any site not to offer the tried-and-trusted email and password, even just as as a fallback option, especially these days where trust in online stuff is seemingly at an all-time low.

Google, Facebook, et al., companies with massively larger, dedicated security departments swore up, down, and sideways that "everyone's data" is "secure" and "encrypted" ";)"